Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and… (CVE-2026-54428)

The Apache HttpComponents Core library, in versions 5.4.2 and earlier and 5.5-beta1 and earlier, contains a vulnerability in its HTTP/2 HPACK decoder. The decoder does not enforce limits or throttling on resource allocation when handling compressed header blocks. An attacker can exploit this by sending oversized compressed header blocks prior to the HTTP/2 SETTINGS acknowledgement, which normally triggers the configured header list size limit. This leads to uncontrolled memory allocation, resulting in denial of service through memory exhaustion.

Remote attackers can cause a denial of service condition by exhausting server memory resources. The vulnerability does not impact confidentiality or integrity but affects availability due to resource exhaustion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing network-level protections to limit oversized HTTP/2 header blocks or apply rate limiting to mitigate potential exploitation.