CVE-2026-54428

Overview

Apache HttpComponents Core (HttpCore) is a set of low-level HTTP transport components for building custom client-side and server-side HTTP services with a minimal footprint. It supports a blocking I/O model based on classic Java I/O and a non-blocking, event-driven I/O model based on Java NIO. HttpCore 5.x is published to Maven Central under org.apache.httpcomponents.core5: httpcore5 provides the HTTP/1.1 components, httpcore5-h2 adds HTTP/2 and httpcore5-reactive adds Reactive Streams support. Apache HttpClient 5.x is built on it.

A denial of service vulnerability (CVE-2026-54428) has been identified in the HTTP/2 HPACK decoder of Apache HttpComponents Core, which allows remote attackers to exhaust memory by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others.

This issue affects multiple versions of Apache HttpComponents Core.

‍

Details

Module Info

• Product: Apache HttpComponents Core
• Affected packages: org.apache.httpcomponents.core5:httpcore5-h2
• Affected versions: >=5.0-alpha <=5.4.2, >=5.5-alpha <=5.5-beta1
• GitHub repository: https://github.com/apache/httpcomponents-core
• Published packages: https://central.sonatype.com/artifact/org.apache.httpcomponents.core5/httpcore5-h2
• Package manager: Maven
• Fixed in:
  • OSS Apache HttpComponents Core 5.4.3, 5.5-beta2
  • NES for Apache HttpComponents Core v5.1.7

Vulnerability Info

This High-severity vulnerability is found in the org.apache.httpcomponents.core5:httpcore5-h2 package in multiple versions of Apache HttpComponents Core.

Every HTTP/2 connection is driven by an AbstractH2StreamMultiplexer, which owns the HPackDecoder that decodes the header blocks received from the peer. The constructor stores the application's H2Config as localConfig, but initializes the decoder's maximum header list size from H2Config.INIT, the protocol's initial settings, rather than from that local configuration:

this.localConfig = h2Config != null ? h2Config : H2Config.DEFAULT;
...
this.hPackDecoder.setMaxListSize(H2Config.INIT.getMaxHeaderListSize());

H2Config.INIT sets the maximum header list size to Integer.MAX_VALUE, and HPackDecoder.decodeHeaders only enforces the limit when it is lower than that value:

final boolean enforceSizeLimit = maxListSize < Integer.MAX_VALUE;

The configured limit is applied only in applyLocalSettings(), which runs when the peer acknowledges the local SETTINGS frame. Until that acknowledgement arrives, the decoder accepts header lists of any size. A remote peer that sends large compressed HEADERS and CONTINUATION blocks without first acknowledging SETTINGS can make the endpoint decode and buffer header lists far larger than the configured limit, leading to memory exhaustion and denial of service for HTTP/2 servers and clients built on HttpCore.

‍

Mitigation

Apache HttpComponents Core 5.1.5, released in November 2022, is the last release of the 5.1 series, and its release notes advise HttpCore 5.1 users to upgrade, so no 5.1.x release is available to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of Apache HttpComponents Core that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Henry Huang (finder)