CVE-2026-54428

🗓️ 01 Jul 2026 17:03:53Reported by MendType

mend🔗 www.mend.io👁 9 Views

Remote DoS in Apache HttpComponents Core via memory exhaustion in the HTTP/2 HPACK decoder.

Reporter	Title	Published	Views	Family All 409
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses httpcore5-h2-5.3.4.jar which is vulnerable to CVE-2026-54428	6 Aug 202614:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite is vulnerable to multiple vulnerabilities	1 Oct 202609:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to linkify-it and httpcore5 (CVE-2026-59887, CVE-2026-54428 & CVE-2026-54399)	31 Jul 202614:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	30 Jul 202606:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by a vulnerability in httpcore5-h2 jar (CVE-2026-54428)	7 Aug 202605:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Decision Intelligence Client Managed Software (Formerly Known as IBM Automation Decision Services) for Oct 2026- Multiple CVEs addressed	6 Nov 202608:27	–	ibm
IBM Security Bulletins	Security Bulletin: Denial of Service Security Vulnerability in Apache HttpComponents Core affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-54428)	15 Sep 202614:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities	30 Jul 202608:39	–	ibm
IBM Security Bulletins	Security Bulletin: Improper input validation, integer overflow, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service	17 Aug 202615:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Allocation of resources without limits or throttling vulnerability in Apache HttpComponents [CVE-2026-54428]	27 Jul 202620:09	–	ibm

Source	Link
openwall	www.openwall.com/lists/oss-security/2026/07/01/3
repo	www.repo.maven.apache.org/maven2/
github	www.github.com/apache/httpcomponents-core
lists	www.lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd
github	www.github.com/apache/httpcomponents-core/commit/cc30ee058a7b10cbf4ad3dd6270ab6d1f6a74c49
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54428.json
github	www.github.com/apache/httpcomponents-core/commit/1ea1239bbbe3442a8382a87279c0a8119a7e358e
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-54428

08 Oct 2026 17:44Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.17.5

CVSS 48.7

EPSS0.00871

SSVC

CWE-770 CWE-400

Apache HttpComponents Core HTTP/2 HPACK decoder denial of service memory exhaustion remote attack