CVE-2026-54428: Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK

[Oleg Kalnichevski <olegk () apache org>]

Severity: Important 

Affected versions:

- Apache HttpComponents Core (org.apache.httpcomponents.core5:httpcore5-h2) 5.5-beta1
- Apache HttpComponents Core (org.apache.httpcomponents.core5:httpcore5-h2) 5.4.2

Description:

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 
and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by 
sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list 
size limit to be applied.

Credit:

Henry Huang <zhuang3 () paypal com> (finder)

References:

https://hc.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-54428