CVE-2026-54399: Apache HttpComponents Core HTTP Parser Denial of Service

Technical summary

CVE-2026-54399 is an uncontrolled resource consumption vulnerability (CWE-400) in Apache HttpComponents Core's HTTP/1.1 message parser. The parser lacks sufficient bounds checking on the total number and size of HTTP headers it will accept from a single request. An unauthenticated remote attacker can exploit this by sending crafted HTTP messages with excessive headers or header values, causing the parser to allocate memory unbounded until the JVM heap is exhausted. This results in out-of-memory conditions and service unavailability. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.

Business impact

Organizations running applications or services built on Apache HttpComponents Core face potential service disruption. Public-facing APIs, microservices, and HTTP-based integrations relying on affected versions are at risk. An attacker can trigger denial of service without authentication or special privileges, requiring only network access to the target service. The impact is availability-focused: legitimate users cannot access the service while it recovers or crashes, but no data theft or corruption occurs. For businesses with SLAs or high availability requirements, even brief outages can result in revenue loss, reputation damage, and customer dissatisfaction.

Affected systems

Apache HttpComponents Core versions 5.4.2 and all earlier versions in the 5.x line are affected, including the 5.5-beta1 pre-release. Any application or framework that depends on these versions—including custom HTTP clients, REST frameworks, API gateways, and proxy solutions—inherits the vulnerability. Java applications explicitly using HttpComponents Core in their classpath are at direct risk. Organizations should inventory their software bill of materials (SBOM) to identify direct and transitive dependencies on HttpComponents Core.

Exploitability

This vulnerability has a CVSS score of 7.5 (HIGH) with a network attack vector, low complexity, and no authentication required. Exploitation is straightforward: an attacker simply sends a single HTTP request with an excessive number of headers or abnormally large header values to a listening service. No special tools, credentials, or user interaction are needed. The attack is remotely triggerable from the network without privileged access. However, the vulnerability is not yet listed as known-exploited in the wild, suggesting it may be newly disclosed or exploitation remains limited at this time.

Remediation

Upgrade Apache HttpComponents Core to a patched version released by the Apache project. Verify the availability of patches via the official Apache HttpComponents Core advisory and security announcements. In the interim, implement network-level mitigations: deploy Web Application Firewalls (WAF) or reverse proxies configured to enforce strict limits on HTTP header count and size, rejecting requests that exceed reasonable thresholds. Monitor application logs and metrics for signs of memory pressure or repeated requests with abnormal headers.

Patch guidance

Consult the Apache HttpComponents Core project security advisory for the official patched version and release timeline. Apply patches promptly to development, staging, and production environments. Test patches thoroughly in staging before production deployment to ensure compatibility with dependent applications. Review dependency management tools (Maven, Gradle, npm, etc.) to automate patch distribution. Consider enabling automated security updates where organizational policy permits.

Detection guidance

Monitor HTTP access logs for requests with an unusually high count of headers or extremely long header field values. Set baseline thresholds appropriate to your application's legitimate use cases. Alert on requests that exceed these thresholds or target known HttpComponents Core integrations. Observe JVM heap usage and garbage collection patterns—a spike in GC activity or out-of-memory exceptions may indicate attack attempts. Implement distributed tracing to correlate memory spikes with specific incoming requests. Network IDS/IPS systems can be tuned to detect patterns of header-based resource exhaustion.

Why prioritize this

Despite being marked HIGH severity, this vulnerability carries moderate practical urgency. The attack surface is limited to services directly exposing HTTP endpoints via HttpComponents Core—not all applications use this library. No known active exploitation exists, reducing immediate threat. However, organizations should prioritize patching if they: operate public APIs or services with network exposure, run critical infrastructure requiring high availability, or host multi-tenant systems where resource exhaustion affects multiple customers. Patch deployment should be planned within a typical vulnerability lifecycle (30–90 days), but not treated as emergency-critical if no evidence of attacks exists.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the combination of network accessibility (AV:N), low complexity (AC:L), no authentication requirement (PR:N), and high impact on availability (A:H). The score does not penalize for lack of confidentiality or integrity impact—this is purely a denial-of-service vector. The score is appropriate for a publicly reachable service. However, in isolated or internal environments with restricted network access, the practical risk is lower; organizations should contextualize the score against their network topology and exposure.

Frequently asked questions