CVE-2026-54399

Overview

Apache HttpComponents Core (HttpCore) is a set of low-level HTTP transport components for building custom client-side and server-side HTTP services with a minimal footprint. It supports a blocking I/O model based on classic Java I/O and a non-blocking, event-driven I/O model based on Java NIO. HttpCore 5.x is published to Maven Central under org.apache.httpcomponents.core5: httpcore5 provides the HTTP/1.1 components, httpcore5-h2 adds HTTP/2 and httpcore5-reactive adds Reactive Streams support. Apache HttpClient 5.x is built on it.

A denial of service vulnerability (CVE-2026-54399) has been identified in the HTTP/1.1 message parser of Apache HttpComponents Core, which allows remote attackers to exhaust memory by sending messages with an excessive number of headers or excessively long header lines.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects multiple versions of Apache HttpComponents Core.

Details

Module Info

• Product: Apache HttpComponents Core
• Affected packages: org.apache.httpcomponents.core5:httpcore5
• Affected versions: >=5.0-alpha1 <=5.4.2, >=5.5-alpha <=5.5-beta1
• GitHub repository: https://github.com/apache/httpcomponents-core
• Published packages: https://central.sonatype.com/artifact/org.apache.httpcomponents.core5/httpcore5
• Package manager: Maven
• Fixed in:
  • OSS Apache HttpComponents Core 5.4.3, 5.5-beta2
  • NES for Apache HttpComponents Core v5.1.7

Vulnerability Info

This High-severity vulnerability is found in the org.apache.httpcomponents.core5:httpcore5 package in multiple versions of Apache HttpComponents Core. The limits that the HTTP/1.1 parser applies to incoming messages come from Http1Config, and every parser and connection that is not given an explicit configuration falls back to Http1Config.DEFAULT. In the affected versions the default builder leaves both the maximum line length and the maximum header count unset:

Builder() {
    this.bufferSize = -1;
    this.chunkSizeHint = -1;
    this.waitForContinueTimeout = Timeout.ofSeconds(3);
    this.maxLineLength = -1;
    this.maxHeaderCount = -1;
    this.maxEmptyLineCount = 10;
    this.initialWindowSize = -1;
}

The parsers only enforce a limit when it is positive. The session input buffers treat any non-positive maxLineLen as 0 and skip the line length check, and the header parser in AbstractMessageParser keeps allocating a new buffer for every header line and appending folded continuation lines to the previous header:

if (maxLineLen > 0
        && previous.length() + 1 + current.length() - i > maxLineLen) {
    throw new MessageConstraintException("Maximum line length limit exceeded");
}
previous.append(' ');
previous.append(current, i, current.length() - i);
...
if (maxHeaderCount > 0 && headerLines.size() >= maxHeaderCount) {
    throw new MessageConstraintException("Maximum header count exceeded");
}

With the default configuration neither check ever fires. A remote peer, either a client sending requests to an HttpCore 5 server or a server answering an HttpCore 5 based client, can therefore send a message head with an arbitrarily long header line or an unlimited number of headers, and the parser buffers all of it in memory until the process runs out of heap. Applications are only protected if they explicitly set setMaxLineLength and setMaxHeaderCount on their Http1Config.

Mitigation

Apache HttpComponents Core 5.1.5, released in November 2022, is the last release of the 5.1 series, and its release notes advise HttpCore 5.1 users to upgrade, so no 5.1.x release is available to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of Apache HttpComponents Core that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Henry Huang (finder)