Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-01T17:03:53 org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.

A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.

This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system's configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16 2026-08-13T00:00:00Z RHSA-2026:54622 httpcore5-h2 Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 2026-07-30T00:00:00Z RHSA-2026:48118 httpcore5-h2 Red Hat build of Quarkus 3.33.2.SP3 2026-07-30T00:00:00Z RHSA-2026:47172 Cryostat 4 Affected httpcore5-h2 OpenShift Developer Tools and Services Affected jenkins OpenShift Developer Tools and Services Affected jenkins-2-plugins OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-rhel8 OpenShift Developer Tools and Services Affected ocp-tools-4/jenkins-rhel9 Red Hat AI Inference Server Not affected rhaiis/vllm-cuda-rhel9 Red Hat AI Inference Server Not affected rhaii/vllm-gaudi-rhel9 Red Hat AMQ Clients Not affected httpcore5-h2 Red Hat build of Apache Camel 4 for Quarkus 3 Affected httpcore5-h2 Red Hat build of Apache Camel - HawtIO 4 Not affected httpcore5-h2 Red Hat build of Apicurio Registry 3 Affected httpcore5-h2 Red Hat build of Debezium 3 Will not fix httpcore5-h2 Red Hat Data Grid 8 Not affected httpcore5-h2 Red Hat Enterprise Linux 9 Under investigation jmc Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-gaudi-rhel9 Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected httpcore5-h2 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-modelmesh-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-vllm-gaudi-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/pluginregistry-rhel9 streams for Apache Kafka 2 Affected httpcore5-h2 streams for Apache Kafka 3 Affected httpcore5-h2 https://www.cve.org/CVERecord?id=CVE-2026-54428 https://nvd.nist.gov/vuln/detail/CVE-2026-54428 http://www.openwall.com/lists/oss-security/2026/07/01/3 https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd