Hi,

The following vulnerabilities were published for httpcomponents-core5.

CVE-2026-54428[0]:
| Allocation of resources without limits or throttling in the HTTP/2
| HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier,
| 5.5-beta1 and earlier) allows an remote attacker to cause a denial
| of service through memory exhaustion by sending oversized compressed
| header blocks before the HTTP/2 SETTINGS acknowledgement causes the
| configured header list size limit to be applied.


CVE-2026-54399[1]:
| Uncontrolled Resource Consumption vulnerability in the HTTP/1.1
| message parser in Apache HttpComponents Core (5.4.2 and earlier,
| 5.5-beta1 and earlier) allows an remote attacker to cause a denial
| of service through memory exhaustion by sending messages with
| excessive number of headers / excessive header length


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-54428
https://www.cve.org/CVERecord?id=CVE-2026-54428
[1] https://security-tracker.debian.org/tracker/CVE-2026-54399
https://www.cve.org/CVERecord?id=CVE-2026-54399

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
httpcomponents-core5, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1141387@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jérôme Charaoui <jerome@riseup.net> (supplier of updated httpcomponents-core5 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 08 Aug 2026 00:05:46 -0400
Source: httpcomponents-core5
Architecture: source
Version: 5.4.3-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Jérôme Charaoui <jerome@riseup.net>
Closes: 1141387 1143144
Changes:
 httpcomponents-core5 (5.4.3-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream version 5.4.3, fixing CVE-2026-54399 and CVE-2026-54428
     (Closes: #1141387)
   * add back missed nmu changelog entry and patch (Closes: #1143144)
   * drop redundant Priority: optional source field
   * dump Standards-Version, no changes needed
Checksums-Sha1:
 0d4c1fa6bed3c68748bbaa5c47f3aadf3714ba86 1547 httpcomponents-core5_5.4.3-1.dsc
 0940c10501351cef377085905ed882a014f8dfd9 793778 httpcomponents-core5_5.4.3.orig.tar.gz
 d955c5977db4f182b0d397d5df9f61e1c59d8328 4160 httpcomponents-core5_5.4.3-1.debian.tar.xz
 dc54ea9b71b3b2bfbcc41b2373d18e161984fd0d 9531 httpcomponents-core5_5.4.3-1_amd64.buildinfo
Checksums-Sha256:
 081df66a332d3edd2a81d652de7efbf876bca27c1865184e2dab79669f5646eb 1547 httpcomponents-core5_5.4.3-1.dsc
 52c3c27419f918c6712eff5e2d628fa1aaaa234551abc39c809edbe8e3d5a8fc 793778 httpcomponents-core5_5.4.3.orig.tar.gz
 3daf340828f19d01fd2bb0e2c8a1d42864a082a308dbaa2256c54362c091ea49 4160 httpcomponents-core5_5.4.3-1.debian.tar.xz
 29cb8f01ecfc094e4acd7c3e8bd1bb6ae4b24b3c1893b4fd6d912a1597196826 9531 httpcomponents-core5_5.4.3-1_amd64.buildinfo
Files:
 dbc8c22fdd6e0ac3a809da2edb1abdec 1547 java optional httpcomponents-core5_5.4.3-1.dsc
 7a6ada6c8186f627773a9e62f9ac6121 793778 java optional httpcomponents-core5_5.4.3.orig.tar.gz
 3071497ab8437960cd72cedb47fb6ffa 4160 java optional httpcomponents-core5_5.4.3-1.debian.tar.xz
 cd3bb15568a80916b6ab096e26c73c12 9531 java optional httpcomponents-core5_5.4.3-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQTAq04Rv2xblqv/eu5pxS9ljpiFQgUCanassAAKCRBpxS9ljpiF
QiIHAQCIMJgwqB20+ENnnaRahk4LlitWB8uq/uuEUB54OnSHWgEA230fSmPdFGcs
elkcUFrQRYlQKMoFD2J7POhLr0S+MQA=
=0cPc
-----END PGP SIGNATURE-----