{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "cpe": [
              "cpe:2.3:a:apache:httpcomponents_core:*:*:*:*:*:*:*:*",
              "cpe:2.3:a:apache:httpcomponents_core:5.5:alpha1:*:*:*:*:*:*",
              "cpe:2.3:a:apache:httpcomponents_core:5.5:beta1:*:*:*:*:*:*"
            ],
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "5.4.2"
              },
              {
                "introduced": "5.5-alpha1"
              },
              {
                "last_affected": "5.5-alpha1"
              },
              {
                "introduced": "5.5-beta1"
              },
              {
                "last_affected": "5.5-beta1"
              }
            ],
            "source": [
              "CPE_RANGE",
              "CPE_STRING"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "4ee5b2a75b847f9f82a3bfec4524c2cb4f4fb3a6"
            },
            {
              "introduced": "75f51152de1bc5b05dc5576d07c0bec96a5d9bcc"
            },
            {
              "last_affected": "fe165c869e50356c677b319c4ebf32d656352be3"
            }
          ],
          "repo": "https://github.com/apache/httpcomponents-core",
          "type": "GIT"
        }
      ],
      "versions": [
        "5.5-alpha1",
        "5.5-beta1"
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "apache",
    "cwe_ids": [
      "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54399.json",
    "unresolved_ranges": [
      {
        "extracted_events": [
          {
            "introduced": "5.5-alpha"
          },
          {
            "last_affected": "5.5-beta1"
          },
          {
            "introduced": "5.0-alpha"
          },
          {
            "last_affected": "5.4.2"
          }
        ],
        "source": "AFFECTED_FIELD"
      }
    ]
  },
  "details": "Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length",
  "id": "CVE-2026-54399",
  "modified": "2026-07-08T05:36:00.762931511Z",
  "published": "2026-07-01T17:02:21.778Z",
  "references": [
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
    },
    {
      "type": "WEB",
      "url": "https://repo.maven.apache.org/maven2/"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54399.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
    }
  ],
  "schema_version": "1.7.5",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration"
}