TI-2026-39301 Aliases CVE-2026-54428 GHSA-v3jc-474w-2wm6

Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK

MEDIUM 40CWE-400Published 2026-07-01 · Updated 2026-07-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 16 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00871 59th percentileScored 2026-11-07

Fix Partial org.apache.httpcomponents.core5:httpcore5-h2 (Maven): 5.4.3, 5.5-beta2Red Hat: 16 advisoriesRed Hat: 16 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache HttpComponents Core	5.5-alpha – 5.5-beta1; 5.0-alpha – 5.4.2	—	No fix listed	CNA
—	org.apache.httpcomponents.core5:httpcore5-h2 (Maven)	before 5.4.3	5.4.3	Patch available	GHSA-v3jc-474w-2wm6
—	org.apache.httpcomponents.core5:httpcore5-h2 (Maven)	5.5-alpha1 to before 5.5-beta2	5.5-beta2	Patch available	GHSA-v3jc-474w-2wm6

Apache HttpComponents Core VendorApache Affected 5.5-alpha – 5.5-beta1; 5.0-alpha – 5.4.2 Fixed in — No fix listed CNA
org.apache.httpcomponents.core5:httpcore5-h2 (Maven) Vendor— Affected before 5.4.3 Fixed in 5.4.3 Patch available GHSA-v3jc-474w-2wm6
org.apache.httpcomponents.core5:httpcore5-h2 (Maven) Vendor— Affected 5.5-alpha1 to before 5.5-beta2 Fixed in 5.5-beta2 Patch available GHSA-v3jc-474w-2wm6

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:httpcomponents_core::::::::	5.0 – 5.4.2	Vulnerable	Apache
cpe:2.3:a:apache:httpcomponents_core:5.5:alpha1::::::	5.5 alpha1	Vulnerable	Apache
cpe:2.3:a:apache:httpcomponents_core:5.5:beta1::::::	5.5 beta1	Vulnerable	Apache

cpe:2.3:a:apache:httpcomponents_core:*:*:*:*:*:*:*:* Versions 5.0 – 5.4.2 Vulnerable ·Apache
cpe:2.3:a:apache:httpcomponents_core:5.5:alpha1:*:*:*:*:*:* Versions 5.5 alpha1 Vulnerable ·Apache
cpe:2.3:a:apache:httpcomponents_core:5.5:beta1:*:*:*:*:*:* Versions 5.5 beta1 Vulnerable ·Apache

Remediation

Fix · GHSA-v3jc-474w-2wm6 org.apache.httpcomponents.core5:httpcore5-h2 (Maven) Fixed in 5.4.3 Advisory →
Fix · GHSA-v3jc-474w-2wm6 org.apache.httpcomponents.core5:httpcore5-h2 (Maven) Fixed in 5.5-beta2 Advisory →

Red Hat 16 advisories

RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
RHOAI 2.25.12 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
RHSA-2026:68333 Released 2026-09-16 · Red Hat rating Important
Red Hat build of Cryostat security update
- Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9 +5
RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
Red Hat OpenShift Dev Spaces 3.30.0 Release.
- Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7

Show 13 more Red Hat advisories

RHSA-2026:60259 Released 2026-08-26 · Red Hat rating Important
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
- OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
RHSA-2026:60256 Released 2026-08-26 · Red Hat rating Important
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
- OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
RHSA-2026:60254 Released 2026-08-26 · Red Hat rating Important
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
- OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
RHSA-2026:60252 Released 2026-08-26 · Red Hat rating Important
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
- OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
RHSA-2026:60251 Released 2026-08-26 · Red Hat rating Important
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
- OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
RHSA-2026:60250 Released 2026-08-26 · Red Hat rating Important
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
- OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
RHSA-2026:60249 Released 2026-08-26 · Red Hat rating Important
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
- OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
RHSA-2026:60248 Released 2026-08-26 · Red Hat rating Important
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
- OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
RHSA-2026:60247 Released 2026-08-26 · Red Hat rating Important
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
- OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
RHSA-2026:60246 Released 2026-08-26 · Red Hat rating Important
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
- OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
RHSA-2026:60239 Released 2026-08-26 · Red Hat rating Important
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
- OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
RHSA-2026:54622 Released 2026-08-13 · Red Hat rating Important
Red Hat Build of Apache Camel 4.18.3 for Spring Boot release.
- Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
RHSA-2026:48118 Released 2026-07-30 · Red Hat rating Important
Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33 update is now available (RHBQ 3.33.2.SP3)
- Red Hat Build of Apache Camel 3.33.2.SP3 io.netty.netty-codec-haproxy-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.136.Final-redhat-00001.jar +9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Developer Tools and Services	Affected	No fix yet
Red Hat Enterprise Linux 9	Affected	No fix yet
Red Hat build of Apache Camel 4 for Quarkus 3	Affected	No fix yet
Red Hat build of Apicurio Registry 3	Affected	No fix yet
Red Hat build of Debezium 3	Affected	No fix planned: Will not fix
streams for Apache Kafka 3	Affected	No fix yet
Cryostat 4 on RHEL 9	Fixed	RHSA-2026:68333
OpenShift Developer Tools and Services 4.12	Fixed	RHSA-2026:60247
OpenShift Developer Tools and Services 4.13	Fixed	RHSA-2026:60249
OpenShift Developer Tools and Services 4.14	Fixed	RHSA-2026:60248
OpenShift Developer Tools and Services 4.15	Fixed	RHSA-2026:60239
OpenShift Developer Tools and Services 4.16	Fixed	RHSA-2026:60251
OpenShift Developer Tools and Services 4.17	Fixed	RHSA-2026:60246
OpenShift Developer Tools and Services 4.18	Fixed	RHSA-2026:60250
OpenShift Developer Tools and Services 4.19	Fixed	RHSA-2026:60252
OpenShift Developer Tools and Services 4.20	Fixed	RHSA-2026:60259
OpenShift Developer Tools and Services 4.21	Fixed	RHSA-2026:60254
OpenShift Developer Tools and Services 4.22	Fixed	RHSA-2026:60256
Red Hat Build of Apache Camel 3.33.2.SP3	Fixed	RHSA-2026:48118
Red Hat OpenShift AI 2.25	Fixed	RHSA-2026:87410
Red Hat OpenShift Dev Spaces 3.30	Fixed	RHSA-2026:62260
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16	Fixed	RHSA-2026:54622

Not affected: 23 products

Cryostat 4 on RHEL 9
OpenShift Developer Tools and Services 4.12
OpenShift Developer Tools and Services 4.13
OpenShift Developer Tools and Services 4.14
OpenShift Developer Tools and Services 4.15
OpenShift Developer Tools and Services 4.16
OpenShift Developer Tools and Services 4.17
OpenShift Developer Tools and Services 4.18
OpenShift Developer Tools and Services 4.19
OpenShift Developer Tools and Services 4.20
OpenShift Developer Tools and Services 4.21
OpenShift Developer Tools and Services 4.22
Red Hat AI Inference Server
Red Hat AMQ Clients
Red Hat Build of Apache Camel 3.33.2.SP3
Red Hat Data Grid 8
Red Hat Enterprise Linux AI (RHEL AI) 3
Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift AI 2.25
Red Hat OpenShift Dev Spaces 3.30
Red Hat build of Apache Camel - HawtIO 4
streams for Apache Kafka 2

Timeline

2026-10-02 Threatist record created from CVE-2026-54428
2026-10-03 Alias added: GHSA-v3jc-474w-2wm6
2026-10-09 Fix available: RHSA-2026:48118 · Red Hat
2026-10-09 Fix available: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 · Red Hat
2026-10-10 Fix available: Red Hat Build of Apache Camel 3.33.2.SP3 · Red Hat
2026-10-20 Affected versions changed · Red Hat
2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
2026-10-23 Fix available: Red Hat OpenShift AI 2.25 · Red Hat
2026-11-03 Affected versions changed · Red Hat

References

Advisory 3

Other 3

TI-2026-39275 Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences