CVE-2026-54399: apache software foundation apache httpcomponents core Uncontrolled Resource Consumption

CVSS: 7.5v3.1HighAnalyzed

AliasesUBUNTU-CVE-2026-54399DEBIAN-CVE-2026-54399CGA-24g4-vfcc-r48q+285 more

Published 01-07-2026Last modified 01-07-2026

Vulnerability summary

CVE-2026-54399 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in apache software foundation apache httpcomponents core. EPSS estimates a 0.87% chance of exploitation in the next 30 days, higher than 58.1% of scored vulnerabilities.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.87%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1

CGA-J9H8-5CM9-WR95

Timeline

01-07-2026
PublishedVulnerability first disclosed.
01-07-2026
Last modifiedVulnerability information updated.

Description

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.87%

Chance of exploitation in the next 30 days

Percentile

58%

Versus all other CVEs

30-day change

0.00 pp

From 0.87% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.87%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.

Affected systems

Chainguard114 products

airbyte-platform-bootloader< 2.0.0-r1
airbyte-platform-cron< 2.0.0-r1
airbyte-platform-fips-bootloader< 2.0.0-r1
airbyte-platform-fips-cron< 2.0.0-r1
airbyte-platform-fips-server< 2.0.0-r1

airbyte-platform-fips-workers< 2.0.0-r1
airbyte-platform-fips-workload-api-server< 2.0.0-r1
airbyte-platform-fips-workload-launcher< 2.0.0-r1
airbyte-platform-server< 2.0.0-r1
airbyte-platform-workers< 2.0.0-r1
airbyte-platform-workload-api-server< 2.0.0-r1
airbyte-platform-workload-launcher< 2.0.0-r1
airbyte-server< 2.0.0-r10
airbyte-server-fips< 2.0.0-r12
airflow-2All versions (No fix recorded)
akhq< 0.28.0-r3
apache-hop< 2.19.0-r0
apache-hop-fips< 2.19.0-r0
apache-nifi-2.11< 2.11.0-r2
apicurio-registry< 3.3.1-r4
apicurio-registry-fips< 3.3.1-r4
camunda-zeebe-8.6< 8.6.39-r8
cassandra-reaper< 5.0.0-r6
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3All versions (No fix recorded)
conductor< 3.32.1-r1
conductor-fips< 3.32.1-r4
dependency-track-apiserver-4< 4.14.3-r3
druid< 37.0.0-r49 | < 37.0.0-r56
elasticsearch-9.2< 9.2.8-r10
elasticsearch-9.2-iamguarded< 9.2.8-r10
elasticsearch-9.2-iamguarded-fips< 9.2.8-r9
elasticsearch-9.3< 9.3.8-r2
elasticsearch-9.3-iamguarded< 9.3.8-r2
elasticsearch-9.3-iamguarded-fips< 9.3.7-r6
elasticsearch-9.4< 9.4.4-r4
elasticsearch-9.4-iamguarded< 9.4.4-r4
elasticsearch-9.4-iamguarded-fips< 9.4.5-r0
elasticsearch-9.5-iamguarded-fips< 9.5.1-r0
elasticsearch-fips-9.2< 9.2.8-r9
elasticsearch-fips-9.3< 9.3.7-r6
elasticsearch-fips-9.4< 9.4.5-r0
floci< 1.6.0-r1
floci-az< 0.10.0-r1
flyway< 13.7.0-r1
geoserver-3.0< 3.0.0-r7
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r3
jbang< 0.141.0-r2
jmeter< 5.6.3-r3
kayenta-2026.0< 2026.0.7-r1
kayenta-2026.1< 2026.1.2-r3
kayenta-fips-2026.0< 2026.0.5-r1
kayenta-fips-2026.1< 2026.1.2-r3
keycloak-fips-26.7-iamguarded-fipsAll versions (No fix recorded)
kserve-modelmesh< 0.12.0-r39
lmcache-cuda-12.8< 0.5.5-r2
logstash-9.2All versions (No fix recorded)
logstash-9.2-iamguarded-compatAll versions (No fix recorded)
logstash-9.2-with-output-opensearchAll versions (No fix recorded)
logstash-9.3< 9.3.8-r2 | All versions (No fix recorded)
logstash-9.3-iamguarded-compatAll versions (No fix recorded) | < 9.3.8-r2
logstash-9.4< 9.4.5-r1
logstash-9.4-iamguarded-compat< 9.4.5-r1
logstash-9.5< 9.5.1-r3 | < 9.5.2-r3
logstash-9.5-iamguarded-compat< 9.5.1-r3 | < 9.5.2-r3
logstash-fips-9.4< 9.4.5-r3
logstash-fips-9.4-iamguarded-compat< 9.4.5-r3
logstash-fips-9.5< 9.5.2-r4 | < 9.5.1-r1
logstash-fips-9.5-iamguarded-compat< 9.5.1-r1 | < 9.5.2-r4
maven-3.9All versions (No fix recorded)
nacos< 3.2.3-r8
nacos-docker< 3.2.3-r5
nrjmx< 2.13.0-r1
nuxeo-2023< 2023.45-r6
opensearch-2-ml-commons< 2.19.6-r7
opensearch-3< 3.7.0-r14
opensearch-3-alerting< 3.7.0-r14
opensearch-3-anomaly-detection< 3.7.0-r14
opensearch-3-cross-cluster-replication< 3.7.0-r14
opensearch-3-discovery-ec2< 3.8.0-r3
opensearch-3-iamguarded-compatAll versions (No fix recorded)
opensearch-3-k-nn< 3.7.0-r14
opensearch-3-ml-commons< 3.7.0-r14
opensearch-3-neural-searchAll versions (No fix recorded)
opensearch-3-notifications< 3.7.0-r14
opensearch-3-security< 3.7.0-r14
opensearch-3-sql< 3.7.0-r14
opensearch-fips-3< 3.8.0-r1
opensearch-fips-3-alerting< 3.8.0-r1
opensearch-fips-3-anomaly-detection< 3.8.0-r1
opensearch-fips-3-cross-cluster-replication< 3.8.0-r1
opensearch-fips-3-index-management< 3.8.0-r1
opensearch-fips-3-k-nn< 3.8.0-r1
opensearch-fips-3-ml-commons< 3.8.0-r1
opensearch-fips-3-notifications< 3.8.0-r1
opensearch-fips-3-security< 3.8.0-r1
opensearch-fips-3-sql< 3.8.0-r1
pinot< 1.5.1-r13
pinot-fips< 1.5.1-r9
reposilite< 3.6.2-r0
sonarqube< 26.8.0.126808-r1
thingsboard-tb-mqtt-transport< 4.3.1.3-r17
thingsboard-tb-node< 4.3.1.3-r17
traccar< 6.14.5-r3
traccar-fips< 6.14.5-r5
trino-plugin-clickhouseAll versions (No fix recorded)
wavefront-proxy< 13.9-r28
wazuh-indexer-plugin-ml-commons< 4.14.7-r4
wso2is< 7.3.0-r3
zaproxyAll versions (No fix recorded)
zipkin< 3.6.1-r25
zipkin-slim< 3.6.1-r25

Show all 114

Wolfi31 products

akhq< 0.28.0-r3
apicurio-registry< 3.3.1-r4
cassandra-reaper< 5.0.0-r6
druid< 37.0.0-r49 | < 37.0.0-r56
flyway< 13.7.0-r1

Show all 31

Debian2 products

httpcomponents-coreAll versions (No fix recorded)
httpcomponents-core5All versions (No fix recorded) | < 5.4.3-1

Ubuntu2 products

httpcomponents-coreAll versions (No fix recorded)
httpcomponents-core5All versions (No fix recorded)

Apache1 product

httpcomponents_core≥ 5.0, ≤ 5.4.2 | 5.5:alpha1 | 5.5:beta1

Apache software foundation1 product

apache httpcomponents core≥ 5.5-alpha, ≤ 5.5-beta1 | ≥ 5.0-alpha, ≤ 5.4.2

Org.apache.httpcomponents.core51 product

httpcore5< 5.4.3 | ≥ 5.5-alpha1, < 5.5-beta2

7 vendors · 152 products

References

11 links

lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpyVendor AdvisoryREPORTAdvisoryWEBMailing List
www.openwall.com/lists/oss-security/2026/07/01/4REPORTWEBMailing ListThird Party Advisory
ubuntu.com/security/CVE-2026-54399REPORT
www.cve.org/CVERecord?id=CVE-2026-54399REPORT
security-tracker.debian.org/tracker/CVE-2026-54399Advisory
repo.maven.apache.org/maven2/WEB
github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54399.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-54399Advisory
github.com/apache/httpcomponents-core/commit/d96a00fec9b2e19f8005e35681df5f6cd6e21a9eWEB
github.com/apache/httpcomponents-core/commit/fdc53a32fe0fccf098cc67e71cd125e447c759edWEB

Show all 11 references

github.com/apache/httpcomponents-corePACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities