High severity7.5NVD Advisory· Published Jul 1, 2026· Updated Jul 24, 2026
CVE-2026-54428
CVE-2026-54428
Description
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.
Affected products
47cpe:2.3:a:apache:httpcomponents_core:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:apache:httpcomponents_core:*:*:*:*:*:*:*:*range: >=5.0,<=5.4.2
- cpe:2.3:a:apache:httpcomponents_core:5.5:alpha1:*:*:*:*:*:*
- cpe:2.3:a:apache:httpcomponents_core:5.5:beta1:*:*:*:*:*:*
- (no CPE)range: <=5.4.2, <=5.5-beta1
- osv-coords43 versionspkg:apk/chainguard/akhqpkg:apk/chainguard/apache-nifi-2.11pkg:apk/chainguard/apicurio-registrypkg:apk/chainguard/apicurio-registry-fipspkg:apk/chainguard/cassandra-reaperpkg:apk/chainguard/cloudwatch-exporterpkg:apk/chainguard/dependency-track-apiserver-4pkg:apk/chainguard/druidpkg:apk/chainguard/elasticsearch-9.2pkg:apk/chainguard/elasticsearch-9.2-iamguardedpkg:apk/chainguard/elasticsearch-9.2-iamguarded-fipspkg:apk/chainguard/elasticsearch-9.3pkg:apk/chainguard/elasticsearch-9.3-iamguardedpkg:apk/chainguard/elasticsearch-9.3-iamguarded-fipspkg:apk/chainguard/elasticsearch-9.4pkg:apk/chainguard/elasticsearch-9.4-iamguardedpkg:apk/chainguard/elasticsearch-9.4-iamguarded-fipspkg:apk/chainguard/elasticsearch-fips-9.2pkg:apk/chainguard/elasticsearch-fips-9.3pkg:apk/chainguard/elasticsearch-fips-9.4pkg:apk/chainguard/flocipkg:apk/chainguard/floci-azpkg:apk/chainguard/geoserver-3.0pkg:apk/chainguard/jbangpkg:apk/chainguard/kayenta-2026.0pkg:apk/chainguard/kayenta-2026.1pkg:apk/chainguard/kayenta-fips-2026.0pkg:apk/chainguard/kayenta-fips-2026.1pkg:apk/chainguard/nrjmxpkg:apk/chainguard/pinotpkg:apk/chainguard/pinot-fipspkg:apk/chainguard/reposilitepkg:apk/chainguard/thingsboard-tb-mqtt-transportpkg:apk/chainguard/thingsboard-tb-nodepkg:apk/chainguard/traccar-fipspkg:apk/wolfi/akhqpkg:apk/wolfi/apicurio-registrypkg:apk/wolfi/cassandra-reaperpkg:apk/wolfi/cloudwatch-exporterpkg:apk/wolfi/druidpkg:apk/wolfi/nrjmxpkg:apk/wolfi/thingsboard-tb-mqtt-transportpkg:apk/wolfi/thingsboard-tb-node
< 0.28.0-r4+ 42 more
- (no CPE)range: < 0.28.0-r4
- (no CPE)range: < 2.11.0-r3
- (no CPE)range: < 3.3.1-r5
- (no CPE)range: < 3.3.1-r3
- (no CPE)range: < 5.0.0-r7
- (no CPE)range: < 0.18.0-r2
- (no CPE)range: < 4.14.3-r4
- (no CPE)range: < 37.0.0-r50
- (no CPE)range: < 9.2.8-r11
- (no CPE)range: < 9.2.8-r11
- (no CPE)range: < 9.2.8-r10
- (no CPE)range: < 9.3.8-r3
- (no CPE)range: < 9.3.8-r3
- (no CPE)range: < 9.3.7-r6
- (no CPE)range: < 9.4.5-r0
- (no CPE)range: < 9.4.5-r0
- (no CPE)range: < 9.4.5-r0
- (no CPE)range: < 9.2.8-r10
- (no CPE)range: < 9.3.7-r6
- (no CPE)range: < 9.4.5-r0
- (no CPE)range: < 1.6.0-r2
- (no CPE)range: < 0.10.0-r2
- (no CPE)range: < 3.0.1-r1
- (no CPE)range: < 0.141.0-r3
- (no CPE)range: < 2026.0.7-r2
- (no CPE)range: < 2026.1.2-r3
- (no CPE)range: < 2026.0.5-r1
- (no CPE)range: < 2026.1.2-r3
- (no CPE)range: < 2.13.0-r2
- (no CPE)range: < 1.5.1-r14
- (no CPE)range: < 1.5.1-r10
- (no CPE)range: < 3.6.2-r1
- (no CPE)range: < 4.3.1.3-r18
- (no CPE)range: < 4.3.1.3-r18
- (no CPE)range: < 6.14.5-r6
- (no CPE)range: < 0.28.0-r4
- (no CPE)range: < 3.3.1-r5
- (no CPE)range: < 5.0.0-r7
- (no CPE)range: < 0.18.0-r2
- (no CPE)range: < 37.0.0-r50
- (no CPE)range: < 2.13.0-r2
- (no CPE)range: < 4.3.1.3-r18
- (no CPE)range: < 4.3.1.3-r18
Patches
Vulnerability mechanics
References
6- www.openwall.com/lists/oss-security/2026/07/01/3nvdMitigationThird Party Advisory
- github.com/advisories/GHSA-v3jc-474w-2wm6ghsaADVISORY
- lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sdnvdMitigationVendor Advisory
- github.com/apache/httpcomponents-core/commit/1ea1239bbbe3442a8382a87279c0a8119a7e358eghsa
- github.com/apache/httpcomponents-core/commit/cc30ee058a7b10cbf4ad3dd6270ab6d1f6a74c49ghsa
- nvd.nist.gov/vuln/detail/CVE-2026-54428ghsa
News mentions
0No linked articles in our index yet.