CVE-2026-54399

High

Advisory

Published 1 Jul 2026In the index since 5 Sept 2026

Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service

Carried by container images the latest versions of 149 of 17,787 indexed charts deploy, on 164 images.

Affected package	Affected versions	Fixed in	Images
httpcore5maven	5.0.1, 5.0.2, 5.1.1, 5.1.3+14 more	5.4.3	164

149 by stars

Chart	Latest	Affected images	Radar Score

164 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
public.ecr.aws/aktosecurity/akto-api-security-mini-runtime :latest	5d55a742a2bc	httpcore5@5.2.4	5.4.3	1
public.ecr.aws/aktosecurity/akto-api-security-mini-runtime :latest	8be3ed26f746	httpcore5@5.2.4	5.4.3	1
public.ecr.aws/aktosecurity/akto-api-security-mini-testing :1.72.6_local	43316f900242	httpcore5@5.2.4	5.4.3	1
public.ecr.aws/aktosecurity/akto-api-security-runtime :latest	facdfba6d4e4	httpcore5@5.2.4	5.4.3	1
public.ecr.aws/aktosecurity/akto-api-testing :latest	97d830d5538a	httpcore5@5.2.4	5.4.3	1
public.ecr.aws/aktosecurity/akto-threat-detection :latest	3f103ce347ce	httpcore5@5.2.4	5.4.3	1
public.ecr.aws/aktosecurity/akto-threat-detection :1.16.2	a47eb6cc17ea	httpcore5@5.2.4	5.4.3	1
public.ecr.aws/v0r6c2e2/trino :latest	c265156b00d1	httpcore5@5.3.3	5.4.3	1
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	httpcore5@5.0.2	5.4.3	1
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	httpcore5@5.0.2	5.4.3	1
quay.io/opsmxpublic/ubi8-gate :isd-spin-2025.10.01-5c720954-202511260810	2b3554029737	httpcore5@5.1.5	5.4.3	1
quay.io/opsmxpublic/ubi8-oes-autopilot :isd-spin-2025.10.01-af26a30d4-202511261054	58bd0bcf72f9	httpcore5@5.2.4	5.4.3	1
quay.io/opsmxpublic/ubi8-oes-platform :isd-spin-2025.10.01-a7c191ec-202511261122	8ed603ab7417	httpcore5@5.2.4	5.4.3	1
quay.io/wi_stefan/dss-validation-service :0.0.1	8e928db29ee1	httpcore5@5.3.1	5.4.3	1