CVE-2026-54399

highpriority · track · 0EPSS 0.008 · 55 %ileDEEUFRNLUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.78% (55th) EPSS

CVSS 7.5 · high

Is it mine?

84 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · cert_bund · ncsc_nl

EPSS · scored 2026-10-22

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondaryexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-400USCWE-400USCWE-770US

affected products (84)

Products and version ranges known to be affected.

Communicationsall versionscert_bundDEcpe:/a:oracle:communications:25.2.201
Communicationsall versionscert_bundDEcpe:/a:oracle:communications:47.0.0.2.0
Communicationsall versionscert_bundDEcpe:/a:oracle:communications:26.1.202
Communicationsall versionscert_bundDEcpe:/a:oracle:communications:25.2.202
Communicationsall versionscert_bundDEcpe:/a:oracle:communications:7.5.1
Communicationsall versionscert_bundDEcpe:/a:oracle:communications:24.2.4-25.2.000
Communicationsall versionscert_bundDEcpe:/a:oracle:communications:7.0.0
Communicationsall versionscert_bundDEcpe:/a:oracle:communications:8.0-8.3
Communicationsall versionscert_bundDEcpe:/a:oracle:communications:8.0-8.1
Communicationsall versionscert_bundDEcpe:/a:oracle:communications:26.1.200
Fusion Middlewareall versionscert_bundDEcpe:/a:oracle:fusion_middleware:27.0.0
Fusion Middlewareall versionscert_bundDEcpe:/a:oracle:fusion_middleware:3.0.0-3.2.21
Fusion Middlewareall versionscert_bundDEcpe:/a:oracle:fusion_middleware:4.0.0-4.5.5
Oracle Communications 11.0all versionscert_bundDEcpe:/a:oracle:communications:11.0
Oracle Communications 14.0all versionscert_bundDEcpe:/a:oracle:communications:14.0
Oracle Communications 15.0.0.0.0all versionscert_bundDEcpe:/a:oracle:communications:15.0.0.0.0
Oracle Communications 15.0.1.0.0all versionscert_bundDEcpe:/a:oracle:communications:15.0.1.0.0
Oracle Communications 15.1.0.0.0all versionscert_bundDEcpe:/a:oracle:communications:15.1.0.0.0
Oracle Communications 15.2.0.0.0all versionscert_bundDEcpe:/a:oracle:communications:15.2.0.0.0
Oracle Communications 25.1.100all versionscert_bundDEcpe:/a:oracle:communications:25.1.100

showing 20 of 84

advisories (8)

Vendor and ecosystem advisories describing this.

NCSC-2026-0448Kwetsbaarheden verholpen in Oracle Fusion MiddlewareNL2026-10-22csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in diverse producten, waaronder Oracle SOA Suite, Oracle WebLogic Server, Oracle Data Integrator, Oracle Identity Manager, Oracle Access Manager, Oracle WebCenter Content, Oracle Fusion Middleware (inclusief Helidon) en Oracle HTTP Server.
WID-SEC-W-2026-2172Apache HttpComponents Core: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2026-07-01csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache HttpComponents Core ausnutzen, um einen Denial of Service Angriff durchzuführen.
WID-SEC-W-2026-4056Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere SchwachstellenDeutsch2026-10-20csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira ausnutzen, um Daten zu manipulieren, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode auszuführen.
WID-SEC-W-2026-4061Oracle Database Server: Mehrere SchwachstellenDeutsch2026-10-20csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Database Server ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2026-4078Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2026-10-20csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2026-4090Oracle Communications: Mehrere SchwachstellenDeutsch2026-10-20csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
GHSA-hf6x-8p5f-cgmfApache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service2026-07-01ghsa · osvUS
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows a remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length
CERTFR-2026-AVI-1349Multiples vulnérabilités dans Oracle Database ServerFrançais2026-10-21vendor · certfrFR

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund ncsc_nl osv certfr NVD CVE.org MITRE

published 2026-07-01modified 2026-07-24

references (5)

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2026/07/01/4 cnnvd
https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy cnnvd
https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy enisa_euvd
http://www.openwall.com/lists/oss-security/2026/07/01/4Mailing ListThird Party Advisorynvd
https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpyMailing ListVendor Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan