Apache Httpcomponents Core

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:apache_software_foundation:apache_httpcomponents_core:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorApache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a)
ProductApache Httpcomponents Core (8156a16e-bc9a-5606-b88a-74f6ba1a1000)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-54428 vulnerable 2026-07-29 01:00:27.809608 Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.
Published: 2026-07-01T17:03:53.938Z
Updated: 2026-07-01T18:15:56.634Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-54399 vulnerable 2026-07-29 01:00:27.735725 Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length
Published: 2026-07-01T17:02:21.778Z
Updated: 2026-07-01T17:36:47.358Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.