Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-01T17:02:21 org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length

A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.

Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability. To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect. Cryostat 4 Affected httpcore Cryostat 4 Affected httpcore5 OpenShift Developer Tools and Services Affected jenkins-2-plugins OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-rhel8 OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-cuda-rhel9 Red Hat AI Inference Server Will not fix rhaii/vllm-gaudi-rhel9 Red Hat AMQ Broker 7 Not affected httpcore Red Hat AMQ Clients Affected httpcore Red Hat AMQ Clients Not affected httpcore5 Red Hat build of Apache Camel 4 for Quarkus 3 Affected httpcore Red Hat build of Apache Camel 4 for Quarkus 3 Affected httpcore5 Red Hat build of Apache Camel for Spring Boot 4 Affected httpcore Red Hat build of Apache Camel for Spring Boot 4 Affected httpcore5 Red Hat build of Apache Camel - HawtIO 4 Affected httpcore Red Hat build of Apache Camel - HawtIO 4 Not affected httpcore5 Red Hat build of Apicurio Registry 3 Not affected httpcore Red Hat build of Apicurio Registry 3 Affected httpcore5 Red Hat build of Debezium 3 Will not fix httpcore5 Red Hat Build of Keycloak Affected httpcore Red Hat Build of Keycloak Affected rhbk/keycloak-rhel9 Red Hat Build of Keycloak Affected rhbk/keycloak-rhel9-operator Red Hat Build of Keycloak Affected rhbk-openshift-rhel9/rhbk-openshift-rhel9 Red Hat Build of Keycloak Affected rhbk-rhel9-operator/rhbk-rhel9-operator Red Hat build of Quarkus Not affected httpcore Red Hat Data Grid 8 Will not fix httpcore Red Hat Data Grid 8 Not affected httpcore5 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat JBoss Enterprise Application Platform 7 Fix deferred eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Fix deferred eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Fix deferred eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Fix deferred httpcore Red Hat JBoss Enterprise Application Platform 7 Fix deferred jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 8 Not affected httpcore Red Hat JBoss Enterprise Application Platform 8 Not affected jboss-eap-8-tech-preview/eap81-openjdk17-builder-openshift-rhel9 Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected httpcore Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected httpcore5 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-modelmesh-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-spark-operator-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-trustyai-service-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-vllm-gaudi-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/pluginregistry-rhel9 Red Hat Single Sign-On 7 Fix deferred httpcore streams for Apache Kafka 2 Affected httpcore streams for Apache Kafka 2 Affected httpcore5 streams for Apache Kafka 3 Affected httpcore streams for Apache Kafka 3 Affected httpcore5 https://www.cve.org/CVERecord?id=CVE-2026-54399 https://nvd.nist.gov/vuln/detail/CVE-2026-54399 http://www.openwall.com/lists/oss-security/2026/07/01/4 https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy