Memory exhaustion DoS in Apache HttpComponents Core HTTP/1.1 message parser

CVE-2026-54399 is an uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser of Apache HttpComponents Core. In affected versions, the default parser configuration permits processing of HTTP/1.1 messages containing an excessive number of headers or excessively long header lines without adequate resource limiting. A remote attacker can send crafted HTTP requests or responses that force the parser to consume excessive memory while handling header data, resulting in denial of service. The issue affects Apache HttpComponents Core 5.4.2 and earlier, and 5.5-beta1 and earlier.