CVE-2026-54399: Apache HttpComponents Core DoS Vulnerability

CVE-2026-54399 Overview

CVE-2026-54399 is an uncontrolled resource consumption vulnerability [CWE-400] in the HTTP/1.1 message parser of Apache HttpComponents Core. The flaw affects versions 5.4.2 and earlier, as well as 5.5-beta1 and earlier. Remote attackers can trigger memory exhaustion by sending HTTP messages containing an excessive number of headers or headers with excessive length. Successful exploitation results in denial of service against applications and services that depend on Apache HttpComponents Core for HTTP message parsing. The attack requires no authentication and no user interaction, making any exposed HTTP endpoint parsing untrusted input a viable target.

Critical Impact
Unauthenticated remote attackers can exhaust server memory and cause denial of service by sending crafted HTTP/1.1 messages with oversized or numerous headers.

Affected Products

Apache HttpComponents Core 5.4.2 and earlier
Apache HttpComponents Core 5.5-beta1 and earlier
Downstream applications and services embedding vulnerable HttpComponents Core releases

Discovery Timeline

2026-07-01 - CVE-2026-54399 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-54399

Vulnerability Analysis

The vulnerability resides in the HTTP/1.1 message parser used by Apache HttpComponents Core. The parser accepts HTTP messages without enforcing sufficient upper bounds on the number of headers or their cumulative length. When processing crafted requests or responses, the parser allocates memory proportional to attacker-controlled input. Sustained abuse leads to memory exhaustion in the hosting Java Virtual Machine (JVM) and causes the application to become unresponsive or terminate.

The issue is classified under [CWE-400] Uncontrolled Resource Consumption. Impact is limited to availability. Confidentiality and integrity are not affected. The attack vector is network-based and requires no privileges or user interaction.

Root Cause

The HTTP/1.1 parser lacks strict enforcement of header count and header length limits during message decoding. Each parsed header consumes heap memory to store name and value pairs. Without a hard cap on the total resources allocated for header parsing, an attacker can force the parser into allocating attacker-controlled quantities of memory per connection. The root cause is missing input constraints on header quantity and per-header size during message ingestion.

Attack Vector

A remote attacker sends HTTP/1.1 messages containing either thousands of individual headers or headers with extremely long field values. Servers or clients built on Apache HttpComponents Core parse these messages and allocate memory for each header entry. Repeated or parallel requests amplify the memory pressure and drive the target process toward OutOfMemoryError. Any network-reachable service that parses untrusted HTTP/1.1 traffic through the vulnerable component is exposed.

Technical details are documented in the Apache Mailing List Thread and the Openwall OSS Security Post.

Detection Methods for CVE-2026-54399

Indicators of Compromise

HTTP requests containing an unusually high number of header fields, often several hundred or more per message.
HTTP requests with individual header values that far exceed typical sizes, such as multi-kilobyte or larger values.
Repeated OutOfMemoryError entries or JVM heap exhaustion events in application logs coinciding with inbound HTTP traffic.
Sudden growth in JVM heap usage or garbage collection activity on hosts running Apache HttpComponents Core.

Detection Strategies

Inspect HTTP request logs and web application firewall (WAF) telemetry for anomalous header counts and header sizes.
Correlate application crashes or restarts with concurrent inbound HTTP traffic volumes and source IPs.
Enable verbose HTTP parser logging in non-production environments to identify malformed or oversized headers.

Monitoring Recommendations

Monitor JVM metrics for heap saturation, prolonged garbage collection pauses, and process restarts on services embedding Apache HttpComponents Core.
Alert on WAF or reverse proxy rules that flag requests exceeding header count or header length thresholds.
Track outbound HTTP client behavior when consuming untrusted responses to detect client-side memory pressure.

How to Mitigate CVE-2026-54399

Immediate Actions Required

Inventory all applications and third-party dependencies that ship Apache HttpComponents Core 5.4.2 or earlier, or 5.5-beta1 or earlier.
Upgrade Apache HttpComponents Core to a fixed release once available from the Apache HttpComponents project.
Place a reverse proxy or WAF in front of exposed HTTP endpoints and enforce strict header count and header size limits.

Patch Information

Apache HttpComponents Core versions 5.4.2 and earlier and 5.5-beta1 and earlier are affected. Refer to the Apache Mailing List Thread and the Openwall OSS Security Post for fixed version guidance and upgrade instructions.

Workarounds

Enforce maximum header count and maximum header size at an upstream reverse proxy, load balancer, or WAF.
Restrict network exposure of vulnerable services to trusted clients until the patched version is deployed.
Apply rate limiting and connection quotas per source address to reduce the amplification potential of oversized header attacks.

bash

# Example nginx reverse proxy limits to bound header count and size
# Place in the http { } block
large_client_header_buffers 4 8k;
client_header_buffer_size 4k;
client_max_body_size 1m;
client_header_timeout 10s;
limit_req_zone $binary_remote_addr zone=http_rl:10m rate=20r/s;

server {
    listen 443 ssl;
    limit_req zone=http_rl burst=40 nodelay;
    proxy_pass http://backend_httpcomponents;
}