CVE-2026-54399 Security Details

CVE ID

CVE-2026-54399

CWE

CWE-400

NVD-CWE-noinfo

CVE Description

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length

Published

Jul 2, 2026

CVSS Score & Severity

8.7High

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS Score

0.870%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/apache/hc/core5/http/config/H1Config.copy(Lorg/apache/hc/core5/http/config/H1Config;)Lorg/apache/hc/core5/http/config/H1Config$Builder;

JVM

org/apache/hc/core5/http/config/Http1Config.copy(Lorg/apache/hc/core5/http/config/Http1Config;)Lorg/apache/hc/core5/http/config/Http1Config$Builder;

JVM

org/apache/hc/core5/http/config/MessageConstraints.copy(Lorg/apache/hc/core5/http/config/MessageConstraints;)Lorg/apache/hc/core5/http/config/MessageConstraints$Builder;

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

Apache · AnnouncementPROJECT