CYBERSIXT Signal Over Noise
All CVEs
Vulnerability intelligence

CVE-2026-54428

CWE-770

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.

CVSS Score
7.5
High
EPSS — Exploit Probability
0.4%
Riskier than 33% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
unknown
Check vendor advisories
NVD entry PoC / advisory

1 article across 1 outlet · first covered Jul 2, 2026 · latest Jul 2, 2026

Coverage timeline