Severity: Important Affected versions:
- Apache HttpComponents Core (org.apache.httpcomponents.core5:httpcore5-h2) 5.5-beta1 - Apache HttpComponents Core (org.apache.httpcomponents.core5:httpcore5-h2) 5.4.2 Description: Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied. Credit: Henry Huang <[email protected]> (finder) References: https://hc.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-54428
