Apache HttpComponents Core Patches Two DoS Vulnerabilities in HTTP Parsers

The report discloses two important Apache HttpComponents Core vulnerabilities (CVE-2026-54399 and CVE-2026-54428) that enable unauthenticated remote denial-of-service through memory exhaustion by abusing unbounded HTTP/1.1 headers and HPACK decoding before SETTINGS ACK; affected httpcore5 and httpcore5-h2 releases (5.4.2 and earlier, plus 5.5-beta1) have patched builds available and operators are advised to update dependencies and enforce header limits at the edge. No exploitation in the wild or public proof-of-concept has been confirmed.