Apache Httpcomponents Core — known CVE vulnerabilities

Every CVE whose affected-product data names Apache Httpcomponents Core, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (2)

• CVE-2026-54399 — CVSS 7.5 (high): Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1…
• CVE-2026-54428 — CVSS 7.5 (high): Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier…