CVE-2026-54428 Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK
Remote attackers can cause denial of service via memory exhaustion in Apache HttpComponents Core by sending oversized HPACK headers before SETTINGS ACK.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54428?
CVE-2026-54428 is a high-severity denial of service vulnerability in Apache HttpComponents Core, published on 1 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.
Which versions are affected by CVE-2026-54428?
4 open source packages ship an affected version, including org.apache.httpcomponents.core5:httpcore5-h2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.httpcomponents.core5:httpcore5-h2 Maven | All versions | 5.4.3 |
org.apache.httpcomponents.core5:httpcore5-h2 Maven | All versions | 5.4.3 |
org.apache.httpcomponents.core5:httpcore5-h2 Maven | From 5.5-alpha1 | 5.5-beta2 |
org.apache.httpcomponents.core5:httpcore5-h2 Maven | From 5.5-alpha1 | 5.5-beta2 |
Products include Apache Httpcomponents Core.
How do I fix CVE-2026-54428?
Upgrade org.apache.httpcomponents.core5:httpcore5-h2 to a fixed version for your release line: 5.4.3 or 5.5-beta2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-54428 being exploited?
There is no known exploitation of CVE-2026-54428 in the wild and no public exploit code.
Other vulnerabilities in Apache HttpComponents Core
Sources
Also known as CLEANSTART-2026-FB65905, CLEANSTART-2026-GO38541, CLEANSTART-2026-MM56894, CLEANSTART-2026-SC69074, CLEANSTART-2026-XZ10656, CLSA-2026-1789375936 and 39 more.