CVE-2026-54399

HighCVSS 7.5/10Last modified Oct 25, 2026

Description

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Jul 1, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-54407.5A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the `Content-Length` header. The server allocates memorCVE-2026-544009.1A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi AccesCVE-2026-544018.8A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges wiCVE-2026-544028.8A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS tCVE-2026-544038.6A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypasCVE-2026-544048.8A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found CVE-2026-544057.5A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Network Application to CVE-2026-544068.7A malicious actor with access to the network and high privileges could exploit a Path Traversal vulnerability found in self-hosted instancesCVE-2026-544078.6A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to byCVE-2026-544089.8A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to byCVE-2026-544098.1A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UnCVE-2026-54417.1An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression rout