org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks

🗓️ 30 Jul 2026 01:40:45Reported by RedHatType

Apache HttpComponents Core HTTP/2 HPACK decoder can be exploited by oversized header blocks to cause denial of service.

Reporter	Title	Published	Views	Family All 27
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to linkify-it and httpcore5 (CVE-2026-59887, CVE-2026-54428 & CVE-2026-54399)	31 Jul 202614:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	30 Jul 202606:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities	30 Jul 202608:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Allocation of resources without limits or throttling vulnerability in Apache HttpComponents [CVE-2026-54428]	27 Jul 202620:09	–	ibm
ATTACKERKB	CVE-2026-54428	1 Jul 202617:03	–	attackerkb
Circl	CVE-2026-54428	1 Jul 202617:01	–	circl
CNVD	Apache HttpComponents Core resource management error vulnerability	8 Jul 202600:00	–	cnvd
CVE	CVE-2026-54428	1 Jul 202617:03	–	cve
Cvelist	CVE-2026-54428 Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK	1 Jul 202617:03	–	cvelist
Debian CVE	CVE-2026-54428	1 Jul 202617:03	–	debiancve

Vulners

Node

AND

redhat quarkusRange<3.33el8

Source	Link
openwall	www.openwall.com/lists/oss-security/2026/07/01/3
access	www.access.redhat.com/security/cve/CVE-2026-54428
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
lists	www.lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-54428
cve	www.cve.org/CVERecord

31 Jul 2026 16:24Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.00587

SSVC