oss-sec mailing list archives

CVE-2026-54399: Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration

From: Oleg Kalnichevski <olegk () apache org>
Date: Wed, 01 Jul 2026 13:12:32 +0000

Severity: important 

Affected versions:

- Apache HttpComponents Core (org.apache.httpcomponents.core5:httpcore5) 5.5-beta1
- Apache HttpComponents Core (org.apache.httpcomponents.core5:httpcore5) 5.4.2

Description:

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and 
earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by 
sending messages with excessive number of headers / excessive header length

Credit:

Henry Huang <zhuang3 () paypal com> (finder)

References:

https://hc.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-54399

Current thread:

CVE-2026-54399: Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration Oleg Kalnichevski (Jul 01)