CVE-2026-54399 Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration
Remote attackers can cause denial of service via memory exhaustion by sending excessive HTTP headers in Apache HttpComponents Core.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54399?
CVE-2026-54399 is a high-severity denial of service vulnerability in Apache HttpComponents Core, published on 1 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length
Weakness: CWE-400
Which versions are affected by CVE-2026-54399?
4 open source packages ship an affected version, including org.apache.httpcomponents.core5:httpcore5. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.httpcomponents.core5:httpcore5 Maven | All versions | 5.4.3 |
org.apache.httpcomponents.core5:httpcore5 Maven | All versions | 5.4.3 |
org.apache.httpcomponents.core5:httpcore5 Maven | From 5.5-alpha1 | 5.5-beta2 |
org.apache.httpcomponents.core5:httpcore5 Maven | From 5.5-alpha1 | 5.5-beta2 |
Products include Apache Httpcomponents Core.
How do I fix CVE-2026-54399?
Upgrade org.apache.httpcomponents.core5:httpcore5 to a fixed version for your release line: 5.4.3 or 5.5-beta2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-54399 being exploited?
There is no known exploitation of CVE-2026-54399 in the wild and no public exploit code.
Other vulnerabilities in Apache HttpComponents Core
Sources
Also known as CLEANSTART-2026-AE51081, CLEANSTART-2026-DM76657, CLEANSTART-2026-EL31068, CLEANSTART-2026-PR17240, CLEANSTART-2026-QY36065, CLSA-2026-1789467085 and 40 more.