Executive brief
Apache HttpComponents Core is a widely-used Java library for building HTTP clients and servers. This vulnerability allows a remote attacker to crash or severely degrade the performance of applications using this library by sending specially crafted HTTP/2 messages that consume excessive memory. The attack requires no authentication or user interaction and can be launched from any network-connected system, making it a significant availability risk for organizations relying on affected versions of the library.
Technical details
The vulnerability exists in the HTTP/2 HPACK (Header Compression for HTTP/2) decoder component of Apache HttpComponents Core. The root cause is improper resource allocation control: the decoder does not enforce the configured header list size limit until after the HTTP/2 SETTINGS frame has been acknowledged. An attacker can exploit this by sending oversized compressed header blocks before the SETTINGS ACK is processed, causing the decoder to allocate unlimited memory for header decompression. This is a classic uncontrolled resource consumption flaw (CWE-400) that can lead to out-of-memory conditions and denial of service. The attack vector is network-based with no authentication or privileges required. Patches are available in versions 5.4.3 and 5.5-beta2.
Affected products
- Apache HttpComponents Core < 5.4.3, >= 5.5-alpha1 and < 5.5-beta2
Timeline
- 2026-07-01: disclosed
- 2026-07-01: patched: Patches available in versions 5.4.3 and 5.5-beta2