Apache Software Foundation Apache Httpcomponents Core vulnerabilities

2 vulnerabilities

Known vulnerabilities in Apache Software Foundation Apache Httpcomponents Core, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.5CVE-2026-54428apache software foundationapache httpcomponents core+146
EPSS score
0.87%
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.7.5CVE-2026-54399apache software foundationapache httpcomponents core+151
EPSS score
0.87%
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length