Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by HTTP message parser vulnerability due to Apache HttpComponents Core

Summary Apache HttpComponents Core is used by IBM Cloud Pak for Data System 1x to provide HTTP client and server functionality. CVE-2026-54399 affects Apache HttpComponents Core's HTTP/1.1 message parser when processing messages with excessive headers or header lengths, allowing remote attackers ...

Security Bulletin: IBM SPSS Modeler is affected by Uncontrolled Resource Consumption vulnerability in Apache HttpComponents Core

Summary Security Bulletin: IBM SPSS Modeler is affected by Uncontrolled Resource Consumption vulnerability in Apache HttpComponents Core. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-54399 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in...

Linux Distros Unpatched Vulnerability : CVE-2026-64607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or...

GHSA-HJCP-JMPX-G3QM Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-64607 Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-64607: Missing Release of Resource after Effective Lifetime

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers

A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or...

org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks

A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Eclipse Vert.x, Eclipse Netty, LangChain4j and Apache Httpcore Vulnerability Details CVEID:CVE-2026-54399 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Allocation of resources without limits or throttling vulnerability in Apache HttpComponents [CVE-2026-54428]

Summary IBM Watson Speech Services Cartridge is vulnerable to an Allocation of resources without limits or throttling vulnerability in Apache HttpComponents due to a flaw in HTTP/2 HPACK decoder which could lead to a D.O.S. CVE-2026-54428. Apache HttpComponents is used in our Java Microservices...

Amazon Linux 2 : httpcomponents-core, --advisory ALAS2-2026-3807 (ALAS-2026-3807)

The version of httpcomponents-core installed on the remote host is prior to 4.2.4-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3807 advisory. Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core 5.4.2 and...

Amazon Linux 2023 : httpcomponents-core, httpcomponents-core-javadoc (ALAS2023-2026-1948)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1948 advisory. Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core 5.4.2 and earlier, 5.5-beta1 and earlier allows an remote attacker to cause a denial of...

Important: httpcomponents-core

Issue Overview: Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core 5.4.2 and earlier, 5.5-beta1 and earlier allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of heade...

CVE-2026-54428

A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size...

Apache HttpComponents Core resource management error vulnerability

Apache HttpComponents Core is an open-source core library for HTTP components developed by the Apache Foundation in the United States. There is a resource management vulnerability in Apache HttpComponents Core. This vulnerability stems from unlimited or throttled resource allocation in the HTTP/2...

CVE-2026-54399

A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or...

Linux Distros Unpatched Vulnerability : CVE-2026-54399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core 5.4.2 and earlier, 5.5-beta1 and earlier allows an...

GHSA-V3JC-474W-2WM6 Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core 5.4.2 and earlier, 5.5-beta1 and earlier allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2...