High severity7.5NVD Advisory· Published Jul 1, 2026· Updated Jul 24, 2026
CVE-2026-54428
CVE-2026-54428
Description
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.httpcomponents.core5:httpcore5-h2Maven | < 5.4.3 | 5.4.3 |
org.apache.httpcomponents.core5:httpcore5-h2Maven | >= 5.5-alpha1, < 5.5-beta2 | 5.5-beta2 |
Affected products
117cpe:2.3:a:apache:httpcomponents_core:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:apache:httpcomponents_core:*:*:*:*:*:*:*:*range: >=5.0,<=5.4.2
- cpe:2.3:a:apache:httpcomponents_core:5.5:alpha1:*:*:*:*:*:*
- cpe:2.3:a:apache:httpcomponents_core:5.5:beta1:*:*:*:*:*:*
- (no CPE)range: <=5.4.2, <=5.5-beta1
- osv-coords113 versionspkg:apk/chainguard/airbyte-platform-bootloaderpkg:apk/chainguard/airbyte-platform-cronpkg:apk/chainguard/airbyte-platform-fips-bootloaderpkg:apk/chainguard/airbyte-platform-fips-cronpkg:apk/chainguard/airbyte-platform-fips-serverpkg:apk/chainguard/airbyte-platform-fips-workerspkg:apk/chainguard/airbyte-platform-fips-workload-api-serverpkg:apk/chainguard/airbyte-platform-fips-workload-launcherpkg:apk/chainguard/airbyte-platform-serverpkg:apk/chainguard/airbyte-platform-workerspkg:apk/chainguard/airbyte-platform-workload-api-serverpkg:apk/chainguard/airbyte-platform-workload-launcherpkg:apk/chainguard/airbyte-serverpkg:apk/chainguard/airbyte-server-fipspkg:apk/chainguard/akhqpkg:apk/chainguard/apache-hoppkg:apk/chainguard/apache-hop-fipspkg:apk/chainguard/apache-nifi-2.11pkg:apk/chainguard/apicurio-registrypkg:apk/chainguard/apicurio-registry-fipspkg:apk/chainguard/cassandra-reaperpkg:apk/chainguard/cloudwatch-exporterpkg:apk/chainguard/conductorpkg:apk/chainguard/conductor-fipspkg:apk/chainguard/dependency-track-apiserver-4pkg:apk/chainguard/druidpkg:apk/chainguard/elasticsearch-9.2pkg:apk/chainguard/elasticsearch-9.2-iamguardedpkg:apk/chainguard/elasticsearch-9.2-iamguarded-fipspkg:apk/chainguard/elasticsearch-9.3pkg:apk/chainguard/elasticsearch-9.3-iamguardedpkg:apk/chainguard/elasticsearch-9.3-iamguarded-fipspkg:apk/chainguard/elasticsearch-9.4pkg:apk/chainguard/elasticsearch-9.4-iamguardedpkg:apk/chainguard/elasticsearch-9.4-iamguarded-fipspkg:apk/chainguard/elasticsearch-9.5-iamguarded-fipspkg:apk/chainguard/elasticsearch-fips-9.2pkg:apk/chainguard/elasticsearch-fips-9.3pkg:apk/chainguard/elasticsearch-fips-9.4pkg:apk/chainguard/flocipkg:apk/chainguard/floci-azpkg:apk/chainguard/geoserver-3.0pkg:apk/chainguard/jbangpkg:apk/chainguard/jmeterpkg:apk/chainguard/kayenta-2026.0pkg:apk/chainguard/kayenta-2026.1pkg:apk/chainguard/kayenta-fips-2026.0pkg:apk/chainguard/kayenta-fips-2026.1pkg:apk/chainguard/kserve-modelmeshpkg:apk/chainguard/logstash-9.4pkg:apk/chainguard/logstash-9.4-iamguarded-compatpkg:apk/chainguard/logstash-9.5pkg:apk/chainguard/logstash-9.5-iamguarded-compatpkg:apk/chainguard/logstash-fips-9.4pkg:apk/chainguard/logstash-fips-9.4-iamguarded-compatpkg:apk/chainguard/logstash-fips-9.5pkg:apk/chainguard/logstash-fips-9.5-iamguarded-compatpkg:apk/chainguard/nacospkg:apk/chainguard/nacos-dockerpkg:apk/chainguard/nrjmxpkg:apk/chainguard/nuxeo-2023pkg:apk/chainguard/opensearch-2-ml-commonspkg:apk/chainguard/opensearch-3pkg:apk/chainguard/opensearch-3-alertingpkg:apk/chainguard/opensearch-3-anomaly-detectionpkg:apk/chainguard/opensearch-3-cross-cluster-replicationpkg:apk/chainguard/opensearch-3-k-nnpkg:apk/chainguard/opensearch-3-ml-commonspkg:apk/chainguard/opensearch-3-notificationspkg:apk/chainguard/opensearch-3-securitypkg:apk/chainguard/opensearch-3-sqlpkg:apk/chainguard/opensearch-fips-3pkg:apk/chainguard/opensearch-fips-3-alertingpkg:apk/chainguard/opensearch-fips-3-anomaly-detectionpkg:apk/chainguard/opensearch-fips-3-cross-cluster-replicationpkg:apk/chainguard/opensearch-fips-3-k-nnpkg:apk/chainguard/opensearch-fips-3-ml-commonspkg:apk/chainguard/opensearch-fips-3-notificationspkg:apk/chainguard/opensearch-fips-3-securitypkg:apk/chainguard/opensearch-fips-3-sqlpkg:apk/chainguard/pinotpkg:apk/chainguard/pinot-fipspkg:apk/chainguard/reposilitepkg:apk/chainguard/sonarqubepkg:apk/chainguard/thingsboard-tb-mqtt-transportpkg:apk/chainguard/thingsboard-tb-nodepkg:apk/chainguard/traccarpkg:apk/chainguard/traccar-fipspkg:apk/chainguard/wavefront-proxypkg:apk/chainguard/wazuh-indexer-plugin-ml-commonspkg:apk/chainguard/wso2ispkg:apk/wolfi/akhqpkg:apk/wolfi/apicurio-registrypkg:apk/wolfi/cassandra-reaperpkg:apk/wolfi/cloudwatch-exporterpkg:apk/wolfi/druidpkg:apk/wolfi/kserve-modelmeshpkg:apk/wolfi/logstash-9.4pkg:apk/wolfi/logstash-9.4-iamguarded-compatpkg:apk/wolfi/nrjmxpkg:apk/wolfi/opensearch-3pkg:apk/wolfi/opensearch-3-alertingpkg:apk/wolfi/opensearch-3-anomaly-detectionpkg:apk/wolfi/opensearch-3-cross-cluster-replicationpkg:apk/wolfi/opensearch-3-k-nnpkg:apk/wolfi/opensearch-3-ml-commonspkg:apk/wolfi/opensearch-3-notificationspkg:apk/wolfi/opensearch-3-securitypkg:apk/wolfi/opensearch-3-sqlpkg:apk/wolfi/sonarqubepkg:apk/wolfi/thingsboard-tb-mqtt-transportpkg:apk/wolfi/thingsboard-tb-nodepkg:apk/wolfi/wavefront-proxy
< 2.0.0-r3+ 112 more
- (no CPE)range: < 2.0.0-r3
- (no CPE)range: < 2.0.0-r3
- (no CPE)range: < 2.0.0-r2
- (no CPE)range: < 2.0.0-r2
- (no CPE)range: < 2.0.0-r2
- (no CPE)range: < 2.0.0-r2
- (no CPE)range: < 2.0.0-r2
- (no CPE)range: < 2.0.0-r2
- (no CPE)range: < 2.0.0-r3
- (no CPE)range: < 2.0.0-r3
- (no CPE)range: < 2.0.0-r3
- (no CPE)range: < 2.0.0-r3
- (no CPE)range: < 2.0.0-r11
- (no CPE)range: < 2.0.0-r16
- (no CPE)range: < 0.28.0-r4
- (no CPE)range: < 2.19.0-r0
- (no CPE)range: < 2.19.0-r0
- (no CPE)range: < 2.11.0-r3
- (no CPE)range: < 3.3.1-r5
- (no CPE)range: < 3.3.1-r3
- (no CPE)range: < 5.0.0-r7
- (no CPE)range: < 0.18.0-r2
- (no CPE)range: < 3.32.1-r1
- (no CPE)range: < 3.32.1-r4
- (no CPE)range: < 4.14.3-r4
- (no CPE)range: < 37.0.0-r50
- (no CPE)range: < 9.2.8-r11
- (no CPE)range: < 9.2.8-r11
- (no CPE)range: < 9.2.8-r10
- (no CPE)range: < 9.3.8-r3
- (no CPE)range: < 9.3.8-r3
- (no CPE)range: < 9.3.7-r6
- (no CPE)range: < 9.4.5-r0
- (no CPE)range: < 9.4.5-r0
- (no CPE)range: < 9.4.5-r0
- (no CPE)range: < 9.5.1-r0
- (no CPE)range: < 9.2.8-r10
- (no CPE)range: < 9.3.7-r6
- (no CPE)range: < 9.4.5-r0
- (no CPE)range: < 1.6.0-r2
- (no CPE)range: < 0.10.0-r2
- (no CPE)range: < 3.0.1-r1
- (no CPE)range: < 0.141.0-r3
- (no CPE)range: < 5.6.3-r3
- (no CPE)range: < 2026.0.7-r2
- (no CPE)range: < 2026.1.2-r3
- (no CPE)range: < 2026.0.5-r1
- (no CPE)range: < 2026.1.2-r3
- (no CPE)range: < 0.12.0-r39
- (no CPE)range: < 9.4.5-r1
- (no CPE)range: < 9.4.5-r1
- (no CPE)range: < 9.5.2-r3
- (no CPE)range: < 9.5.2-r3
- (no CPE)range: < 9.4.5-r3
- (no CPE)range: < 9.4.5-r3
- (no CPE)range: < 9.5.2-r4
- (no CPE)range: < 9.5.2-r4
- (no CPE)range: < 3.2.3-r8
- (no CPE)range: < 3.2.3-r5
- (no CPE)range: < 2.13.0-r2
- (no CPE)range: < 2023.45-r7
- (no CPE)range: < 2.19.6-r7
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 1.5.1-r14
- (no CPE)range: < 1.5.1-r10
- (no CPE)range: < 3.6.2-r1
- (no CPE)range: < 26.8.0.126808-r1
- (no CPE)range: < 4.3.1.3-r18
- (no CPE)range: < 4.3.1.3-r18
- (no CPE)range: < 6.14.5-r4
- (no CPE)range: < 6.14.5-r6
- (no CPE)range: < 13.9-r29
- (no CPE)range: < 4.14.7-r4
- (no CPE)range: < 7.3.0-r3
- (no CPE)range: < 0.28.0-r4
- (no CPE)range: < 3.3.1-r5
- (no CPE)range: < 5.0.0-r7
- (no CPE)range: < 0.18.0-r2
- (no CPE)range: < 37.0.0-r50
- (no CPE)range: < 0.12.0-r39
- (no CPE)range: < 9.4.5-r1
- (no CPE)range: < 9.4.5-r1
- (no CPE)range: < 2.13.0-r2
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 26.8.0.126808-r1
- (no CPE)range: < 4.3.1.3-r18
- (no CPE)range: < 4.3.1.3-r18
- (no CPE)range: < 13.9-r29
Patches
Vulnerability mechanics
References
6- www.openwall.com/lists/oss-security/2026/07/01/3nvdMitigationThird Party AdvisoryWEB
- github.com/advisories/GHSA-v3jc-474w-2wm6ghsaADVISORY
- lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sdnvdMitigationVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-54428ghsaADVISORY
- github.com/apache/httpcomponents-core/commit/1ea1239bbbe3442a8382a87279c0a8119a7e358eghsaWEB
- github.com/apache/httpcomponents-core/commit/cc30ee058a7b10cbf4ad3dd6270ab6d1f6a74c49ghsaWEB
News mentions
0No linked articles in our index yet.