Read the docs
TI-2026-39275 Aliases CVE-2026-54399GHSA-hf6x-8p5f-cgmf

Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration

Priority LOW 34CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 17 fixed, 14 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00779 56th percentileScored 2026-11-07
Fix Partial org.apache.httpcomponents.core5:httpcore5 (Maven): 5.4.3, 5.5-beta2Red Hat: 17 advisoriesRed Hat: 17 fixed, 14 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache HttpComponents Core5.5-alpha – 5.5-beta1; 5.0-alpha – 5.4.2—No fix listedCNA
—org.apache.httpcomponents.core5:httpcore5 (Maven)before 5.4.35.4.3Patch availableGHSA-hf6x-8p5f-cgmf
—org.apache.httpcomponents.core5:httpcore5 (Maven)5.5-alpha1 to before 5.5-beta25.5-beta2Patch availableGHSA-hf6x-8p5f-cgmf
  • Apache HttpComponents Core VendorApache Affected 5.5-alpha – 5.5-beta1; 5.0-alpha – 5.4.2 Fixed in — No fix listed CNA
  • org.apache.httpcomponents.core5:httpcore5 (Maven) Vendor— Affected before 5.4.3 Fixed in 5.4.3 Patch available GHSA-hf6x-8p5f-cgmf
  • org.apache.httpcomponents.core5:httpcore5 (Maven) Vendor— Affected 5.5-alpha1 to before 5.5-beta2 Fixed in 5.5-beta2 Patch available GHSA-hf6x-8p5f-cgmf

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:apache:httpcomponents_core:*:*:*:*:*:*:*:*5.0 – 5.4.2VulnerableApache
cpe:2.3:a:apache:httpcomponents_core:5.5:alpha1:*:*:*:*:*:*5.5 alpha1VulnerableApache
cpe:2.3:a:apache:httpcomponents_core:5.5:beta1:*:*:*:*:*:*5.5 beta1VulnerableApache
  • cpe:2.3:a:apache:httpcomponents_core:*:*:*:*:*:*:*:* Versions 5.0 – 5.4.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:httpcomponents_core:5.5:alpha1:*:*:*:*:*:* Versions 5.5 alpha1 Vulnerable ·Apache
  • cpe:2.3:a:apache:httpcomponents_core:5.5:beta1:*:*:*:*:*:* Versions 5.5 beta1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-hf6x-8p5f-cgmf org.apache.httpcomponents.core5:httpcore5 (Maven) Fixed in 5.4.3 Advisory →
  • Fix · GHSA-hf6x-8p5f-cgmf org.apache.httpcomponents.core5:httpcore5 (Maven) Fixed in 5.5-beta2 Advisory →

Red Hat 17 advisories

  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:68333 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9 +5
  • RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.0 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
Show 14 more Red Hat advisories
  • RHSA-2026:61627 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:60259 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60256 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60254 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60252 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60251 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60250 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60249 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60248 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60247 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60246 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60239 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:54622 Released 2026-08-13 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.3 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
  • RHSA-2026:48118 Released 2026-07-30 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33 update is now available (RHBQ 3.33.2.SP3)
    • Red Hat Build of Apache Camel 3.33.2.SP3 io.netty.netty-codec-haproxy-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.136.Final-redhat-00001.jar +9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4AffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix planned: Will not fix
Red Hat AMQ ClientsAffectedNo fix yet
Red Hat Build of KeycloakAffectedNo fix planned: Will not fix
Red Hat Data Grid 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
Cryostat 4 on RHEL 9Fixed RHSA-2026:68333
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:60247
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:60249
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:60248
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:60239
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:60251
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:60246
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:60250
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:60252
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:60259
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:60254
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:60256
Red Hat AI Inference Server 3.2Fixed RHSA-2026:61627
Red Hat Build of Apache Camel 3.33.2.SP3Fixed RHSA-2026:48118
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:62260
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16Fixed RHSA-2026:54622
Not affected: 27 products
  • Cryostat 4 on RHEL 9
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • Red Hat AMQ Broker 7
  • Red Hat AMQ Clients
  • Red Hat Build of Apache Camel 3.33.2.SP3
  • Red Hat Data Grid 8
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat build of Apache Camel - HawtIO 4
  • Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat build of Apicurio Registry 3
  • Red Hat build of Quarkus
  • streams for Apache Kafka 2
  • streams for Apache Kafka 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54399
  2. 2026-10-03 Alias added: GHSA-hf6x-8p5f-cgmf
  3. 2026-10-07 Affected versions changed · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:48118 · Red Hat
  5. 2026-10-09 Fix available: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 · Red Hat
  6. 2026-10-10 Fix available: Red Hat Build of Apache Camel 3.33.2.SP3 · Red Hat
  7. 2026-10-20 Affected versions changed · Red Hat
  8. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  9. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25 · Red Hat
  10. 2026-11-03 Affected versions changed · Red Hat

References

Advisory 3

Other 3

  • TI-2026-39301 Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences