Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-54428: Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and…

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-54428 key facts

CISA KEV: Not listed (catalog checked Nov 6, 2026)
Highest advisory severity: High
CVSS base score: 7.5 (Apache), 7.5 (Red Hat)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (Red Hat)
Weakness: CWE-770
Fixed releases: Red Hat: cryostat/cryostat-agent-init-rhel9:0.7.0-12, cryostat/cryostat-rhel9:4.2.0-14, org.apache.httpcomponents.core5/httpcore5-h2:5.3.6.redhat-00002, httpcore5-h2, ocp-tools-4/jenkins-rhel8:1786628667, ocp-tools-4/jenkins-rhel8:1786628681 and 28 more in the advisory
Vendor advisories: 2 from Apache, Red Hat
VulniPulse record: Published Jul 7, 2026 · Updated Jul 20, 2026

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-54428; bulletin-wide values are not repeated here.

Is CVE-2026-54428 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-54428 is not in the CISA KEV catalog (checked Nov 6, 2026) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-54428?

Upgrade to a fixed release named by the vendor:

Red Hat: cryostat/cryostat-agent-init-rhel9:0.7.0-12, cryostat/cryostat-rhel9:4.2.0-14, org.apache.httpcomponents.core5/httpcore5-h2:5.3.6.redhat-00002, httpcore5-h2, ocp-tools-4/jenkins-rhel8:1786628667, ocp-tools-4/jenkins-rhel8:1786628681

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. (Red Hat)

Get an email when Apache publishes the next one.

See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Apache

Vendor advisory comparison

Apache

1 advisory

Advisory severityHigh7.5
High [CVE-2026-54428] Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and…
CVE-2026-54428Source published Jul 1, 2026Source updated Jul 6, 2026
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.
Affected products in this advisory
Apache HttpComponents Core
Source-reported affected versions
5.4.2
Source-reported fixed versions
No fixed-version detail extracted. This does not mean no fix exists.
Mitigation guidance
No mitigation guidance extracted; consult the source.
Full advisory and evidence Open source bulletin

Red Hat

1 advisory

Advisory severityHigh7.5
High [CVE-2026-54428] org.apache.httpcomponents.core5/httpcore5: org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks
CVE-2026-54428Source published Jul 1, 2026Source updated Jul 1, 2026
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied. This can lead to the affected system becoming unresponsive. This occurs before the system's configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770.
Affected products in this advisory
Cryostat 4 on RHEL 9
Red Hat Build of Apache Camel 3.33.2.SP3
Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
OpenShift Developer Tools and Services 4.12
19 more entries in the full advisory.
Source-reported affected versions
< 5.4.2
< 5.5-beta1
Source-reported fixed versions
cryostat/cryostat-agent-init-rhel9:0.7.0-12
cryostat/cryostat-rhel9:4.2.0-14
org.apache.httpcomponents.core5/httpcore5-h2:5.3.6.redhat-00002
httpcore5-h2
30 more entries in the full advisory.
Mitigation guidance
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Full advisory and evidence Open source bulletin

All Apache advisories

Follow CVE-2026-54428 in the free weekly digest

Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

iPhone and Android apps · New on the App Store

Get alerts for new CVEs on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts on Android See app features