org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers

🗓️ 30 Jul 2026 07:44:56Reported by RedHatType

Apache HttpComponents Core DoS via excessive HTTP headers and header length causing memory exhaustion in HTTP/1.1 parser.

Reporter	Title	Published	Views	Family All 27
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	30 Jul 202606:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption vulnerability in Apache HttpComponents [CVE-2026-54399]	27 Jul 202620:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities	30 Jul 202608:39	–	ibm
ATTACKERKB	CVE-2026-54399	1 Jul 202617:02	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : httpcomponents-core, httpcomponents-core-javadoc (ALAS2023-2026-1948)	20 Jul 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : httpcomponents-core, --advisory ALAS2-2026-3807 (ALAS-2026-3807)	21 Jul 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-54399	2 Jul 202600:00	–	nessus
Amazon	Important: httpcomponents-core	20 Jul 202600:00	–	amazon
Circl	CVE-2026-54399	1 Jul 202616:56	–	circl
CVE	CVE-2026-54399	1 Jul 202617:02	–	cve

Vulners

Node

AND

Source	Link
openwall	www.openwall.com/lists/oss-security/2026/07/01/4
access	www.access.redhat.com/security/cve/CVE-2026-54399
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
lists	www.lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-54399
cve	www.cve.org/CVERecord

30 Jul 2026 19:36Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00565

SSVC