CVE-2026-54428

A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.

This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system's configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.