CVE-2026-54399Disclosure(apache / httpcomponents_core)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch apache httpcomponents_core systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length

apache CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-400

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

httpcomponents_core

Threat summary

Patch or workaround signal is available
5 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 2d ago at 3 mentions (2026-07-01); latest day: 1
5 total mentions across 3 days

Affected systems

Vendors

apache

Products

httpcomponents_core

1 version affected across 1 product

Deep dive

Activity timeline5 mentions / 3d

Signal classification3 categories

Disclosure

360.0%

Patch

120.0%

General

120.0%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-01	3	Disclosure3
2026-07-02	1	Patch1
2026-07-05	1	General1

Full discourse5 posts

Daily CyberSecurity@the_yellow_fall90d
Patch
Apache HttpComponents Core vulnerabilities CVE-2026-54399 and CVE-2026-54428 allow remote denial of service through memory exhaustion. Upgrade now. #Apache #HttpComponents #DoS #CVE202654399 #CyberSecurity http://securityonline.info/apache-httpcomponents-core-dos/
Post summary
This advisory announces CVE-2026-54399 and CVE-2026-54428 that cause remote denial of service through memory exhaustion, and urges users to upgrade to mitigate the issue.
01020486
12.5K followersView on X
Open Source Security mailing list@oss_security88d
General
Apache HttpComponents Core CVE-2026-54428:: HPackDecoder Unlimited Header List Size Before SETTINGS ACK https://www.openwall.com/lists/oss-security/2026/07/01/3 CVE-2026-54399: Unbounded HTTP Header/Line Length in Default Configuration https://www.openwall.com/lists/oss-security/2026/07/01/4 Both are "Severity: important"
Post summary
The post lists two Apache HttpComponents Core CVEs with a severity rating of important, without providing PoC, exploit, patch, or active exploitation details.
00020408
4.7K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-54399 Uncontrolled Resource Consumption in Apache HttpComponents Core H... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54399 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The text announces the new CVE-2026-54399, titled "Uncontrolled Resource Consumption in Apache HttpComponents Core", and provides a link to a vulnerability detail page, but offers no further technical, exploit, or remediation information.
0000098
4.1K followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-54399 Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remo… https://www.cve.org/CVERecord?id=CVE-2026-54399 ----- Traducción: CVE-2026-54399 Vul… http://infoflow.cloud`
Post summary
The tweet announces the new CVE-2026-54399, gives a brief technical description and links to the CVE record, but contains no PoC, exploit code, active exploitation report, patch, or false‑positive claim.
0000032
90 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-54399 Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remo… https://www.cve.org/CVERecord?id=CVE-2026-54399
Post summary
The text announces CVE‑2026‑54399, detailing an uncontrolled resource consumption flaw in Apache HttpComponents Core, but provides no PoC, exploit, or workaround information.
00000945
57.7K followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	httpcomponents_core	-	-	-
App	apache	httpcomponents_core	5.5	-	-
App	apache	httpcomponents_core	5.5	-	-

Explore more

Back to dashboard apache CVEs httpcomponents_core vulnerabilities

What researchers are saying

CVE-2026-54399

Daily CyberSecurity@the_yellow_fallPatch

This advisory announces CVE-2026-54399 and CVE-2026-54428 that cause remote denial of service through memory exhaustion, and urges users to upgrade to mitigate the issue.

Open Source Security mailing list@oss_securityGeneral

The post lists two Apache HttpComponents Core CVEs with a severity rating of important, without providing PoC, exploit, patch, or active exploitation details.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces the new CVE-2026-54399, titled "Uncontrolled Resource Consumption in Apache HttpComponents Core", and provides a link to a vulnerability detail page, but offers no further technical, exploit, or remediation information.

Infoflowcloud@infoflowcloudDisclosure

The tweet announces the new CVE-2026-54399, gives a brief technical description and links to the CVE record, but contains no PoC, exploit code, active exploitation report, patch, or false‑positive claim.

CVE@CVEnewDisclosure

The text announces CVE‑2026‑54399, detailing an uncontrolled resource consumption flaw in Apache HttpComponents Core, but provides no PoC, exploit, or workaround information.