CVE-2026-54428

7.5 Élevée

Publiée le 01/07/2026 à 20:16 · Modifiée le 24/07/2026 à 22:03 · Analysée par le NVD · Source : security@apache.org

Description

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.

Traduire en français

Produits concernés

Apache Software Foundation Apache HttpComponents Core
Apache httpcomponents core

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-400
CWE-770

Références

https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd MitigationVendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/01/3 MitigationThird Party Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories