CVE-2026-54399 Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration

🗓️ 01 Jul 2026 17:02:21Reported by apacheType

Apache HttpComponents Core may cause denial of service from excessive header count or header length.

Reporter	Title	Published	Views	Family All 41
IBM Security Bulletins	Security Bulletin: IBM i is Affected By Denial of Service Vulnerability in Electronic Service Agent [CVE-2026-54399]	31 Jul 202601:22	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	3 Aug 202611:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to linkify-it and httpcore5 (CVE-2026-59887, CVE-2026-54428 & CVE-2026-54399)	31 Jul 202614:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	30 Jul 202606:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses httpcore5-5.3.4.jar which is vulnerable to CVE-2026-54399	6 Aug 202614:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by a vulnerability in httpcore5 jar (CVE-2026-54399)	7 Aug 202605:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption vulnerability in Apache HttpComponents [CVE-2026-54399]	27 Jul 202620:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by HTTP message parser vulnerability due to Apache HttpComponents Core	7 Aug 202611:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities	30 Jul 202608:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by Uncontrolled Resource Consumption vulnerability in Apache HttpComponents Core	7 Aug 202607:41	–	ibm

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2/",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.httpcomponents.core5:httpcore5",
    "product": "Apache HttpComponents Core",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "5.5-beta1",
        "status": "affected",
        "version": "5.5-alpha",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "5.4.2",
        "status": "affected",
        "version": "5.0-alpha",
        "versionType": "maven"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy

01 Jul 2026 17:06Current

EPSS0.00565

CWE-400