CVE-2026-54428: Apache Software Foundation Apache HttpComponents Core

Описание

Оригинално описание

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.

Засегнати продукти

• Apache Software Foundation Apache HttpComponents Core: 5.5-alpha до 5.5-beta1; 5.0-alpha до 5.4.2

Вид слабост

• CWE-770 Allocation of Resources Without Limits or Throttling
• CWE-400 Неконтролирано потребление на ресурси

История

Други уязвимости в Apache Software Foundation Apache HttpComponents Core

• 7.5CVE-2026-54399

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-54428
• https://nvd.nist.gov/vuln/detail/CVE-2026-54428
• https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd
• http://www.openwall.com/lists/oss-security/2026/07/01/3