CyberRota Analysis
This is a high severity vulnerability with a CVSS score of 7.5. It affects Apache. It may be remotely exploitable. It may lead to a denial-of-service condition.
CVE
CVE-2026-54428
Severity
HIGH
CVSS
7.5
EPSS
0.59%
Apache
Original NVD Description
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.
Related CVEs
Other vulnerabilities affecting the same vendor(s)