CVE-2026-54428: Apache HttpComponents Core HTTP/2 HPACK Memory Exhaustion DoS

Technical summary

The vulnerability exists in the HPACK (HTTP/2 header compression) decoder within Apache HttpComponents Core. During HTTP/2 connection setup, the decoder processes compressed headers without enforcing size limits until after the HTTP/2 SETTINGS frame has been acknowledged by both peers. An attacker exploits this window by sending a compressed header block that decompresses to an exceptionally large size, triggering unbounded memory allocation (CWE-400, CWE-770). Once the SETTINGS acknowledgement completes, the configured header list size limit becomes active, but by then memory exhaustion may already have occurred.

Business impact

Services built on HttpComponents Core that expose HTTP/2 endpoints face a trivial remote denial-of-service risk. A single attacker, without authentication or special privileges, can force memory consumption that crashes the application, disrupting availability. This is particularly critical for backend APIs, microservices, and proxies that rely on this library for HTTP communication and may be exposed directly to untrusted networks.

Affected systems

Apache HttpComponents Core versions 5.4.2 and earlier are vulnerable, as well as 5.5-beta1. Any Java application embedding this library and accepting HTTP/2 connections is potentially affected. This includes services using HttpComponents for client-side requests if they process responses from untrusted HTTP/2 servers, though the more common exposure is server-side ingestion of incoming HTTP/2 traffic.

Exploitability

This vulnerability has a low barrier to exploitation. No authentication, user interaction, or special network access is required—a remote attacker with basic HTTP/2 knowledge can craft a malicious connection within seconds. The attack is deterministic: once the exploit payload is sent, memory exhaustion occurs predictably. The CVSS score of 7.5 (HIGH) reflects the ease of exploitation and complete availability impact, though no confidentiality or integrity is compromised.

Remediation

Upgrade Apache HttpComponents Core to a patched version released by the project. Organizations must verify the exact patched version numbers against Apache's official advisory, as version numbers depend on the release track (5.4.x vs. 5.5.x). Interim mitigations include implementing HTTP/2 connection-level rate limiting, reducing the maximum concurrent connections, or temporarily disabling HTTP/2 support if feasible, though these do not address the root cause.

Patch guidance

Check the Apache HttpComponents project repository and security advisories for the specific patched version numbers for your release branch. After upgrading, validate that the new version is in use in production (check manifest files, dependency trees, and running process metadata). Test the patched version in a staging environment against your normal HTTP/2 traffic patterns before production deployment. If you maintain custom builds or shaded JARs, ensure the upgrade includes the patched httpcomponents-core dependency.

Detection guidance

Monitor for unexpected spikes in memory consumption on services using HttpComponents Core, particularly heap memory in Java processes. Anomalous JVM garbage collection pauses or OutOfMemoryErrors correlated with incoming HTTP/2 connections are red flags. Network-level detection is challenging because the malicious traffic is valid HTTP/2 framing; focus instead on runtime monitoring and logs showing memory pressure during connection establishment. Ensure application monitoring includes heap usage metrics per connection or per application instance.

Why prioritize this

This vulnerability warrants rapid patching because it is remotely exploitable without authentication, affects a foundational library used across many Java applications, and guarantees denial of service with minimal attacker effort. The lack of a KEV listing does not reduce urgency—it reflects the vulnerability's youth (published July 2026) rather than low risk. Organizations running customer-facing or internal services on HttpComponents Core should treat this as critical.

Risk score, explained

The CVSS 7.5 HIGH score appropriately captures the severity: attack vector is network (AV:N), attack complexity is low (AC:L), no privileges or user interaction required (PR:N/UI:N), impact is isolated to availability (A:H, C:N/I:N). The high score reflects the ease and reliability of exploitation, though the impact is limited to availability rather than data breach or code execution.

Frequently asked questions