Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-54399: Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | httpcomponents-core | 0:4.2.4-6.amzn2.0.1 |
| Amazon Linux · 2 | httpcomponents-core-javadoc | 0:4.2.4-6.amzn2.0.1 |
Vulnerabilities 1
-
High 7.5
Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with e…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-54399.html