This PR contains the following updates:

Package	Change	Age	Confidence
org.apache.httpcomponents.core5:httpcore5 (source)	5.3.1 → 5.4.3

Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service

CVE-2026-54399 / GHSA-hf6x-8p5f-cgmf

Details

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows a remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-54399
• https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy
• http://www.openwall.com/lists/oss-security/2026/07/01/4
• https://github.com/apache/httpcomponents-core/commit/d96a00fec9b2e19f8005e35681df5f6cd6e21a9e
• https://github.com/apache/httpcomponents-core/commit/fdc53a32fe0fccf098cc67e71cd125e447c759ed
• https://github.com/advisories/GHSA-hf6x-8p5f-cgmf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

v5.4

This is the first ALPHA release in the 5.4 release series that improves HTTP/2 protocol
support by ensuring conformance to the latest HTTP specification (RFC 9113) and adds
support for Unix domain sockets.

This release also includes all the fixes from the stable 5.3 branch.

Notable changes and features included in the 5.4 series:

• Experimental OFFLOCK (lock-free) connection pool.

• Conformance to RFC 9218 (Extensible Prioritization Scheme for HTTP).

• Improved conformance to RFC 9113 (Hypertext Transfer Protocol Version 2).

• Five-second TCP keep-alive enabled by default.

• Unix domain socket support by the classic and async transports.

• Redesign of classic over async API bridge.

• Improved URI encoding per RFC 3986.

• QUERY method support.

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.