CVE-2026-54399 (High) detected in httpcore5-5.3.1.jar

[mend-bolt-for-github]

CVE-2026-54399 - High Severity Vulnerability

Vulnerable Library - httpcore5-5.3.1.jar

Apache HttpComponents HTTP/1.1 core components

Library home page: https://hc.apache.org/httpcomponents-core-5.3.x/

Sample Path to Dependency File: /hapi-fhir-storage-mdm/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar,/home/wss-scanner/.m2/repository/org/apache/httpcomponents/core5/httpcore5/5.3.1/httpcore5-5.3.1.jar

Dependency Hierarchy:

• hapi-fhir-structures-dstu3-8.11.2-SNAPSHOT.jar (Root Library)
  • org.hl7.fhir.utilities-6.9.4.jar
    • Saxon-HE-11.6.jar
      • xmlresolver-5.2.1.jar
        • httpclient5-5.4.3.jar
          • ❌ httpcore5-5.3.1.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length

Publish Date: 2026-07-01

URL: CVE-2026-54399

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-06-30

Fix Resolution: org.apache.httpcomponents.core5:httpcore5:5.4.3,org.apache.httpcomponents.core5:httpcore5:5.5-beta2,https://github.com/apache/httpcomponents-core.git - rel/v5.4.3,https://github.com/apache/httpcomponents-core.git - v5.5-beta2

---

Step up your Open Source Security Game with Mend here