Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-54399: Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | javapackages-bootstrap | 0:1.5.0^20220105.git9f283b7-3.amzn2023.0.10 |
Vulnerabilities 1
-
High 7.5
Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with e…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-54399.html