CVE-2026-54399¶
WSO2 Products impacted: no
Customer action required: no
REPORTED VULNERABILITY¶
An uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows a remote attacker to cause a denial of service through memory exhaustion by sending messages with an excessive number of headers or excessive header length.1
REPORTED PRODUCTS¶
- WSO2 Identity Server : 7.2.0, 7.3.0
WSO2 JUSTIFICATION¶
In WSO2 Identity Server, httpcore5 is used exclusively as an outbound HTTP client. It is never used as an inbound server transport.
No inbound exposure. The product's inbound HTTP transport is embedded Apache Tomcat. No WSO2 component starts an httpcore5/httpclient5 HTTP server for inbound calls, so the vulnerable HTTP/1.1 message parser is never exposed to attacker-controlled inbound request traffic.
No exposure through the WebAuthn dependency. One copy of the library is nested inside the Yubico WebAuthn bundle, where only DefaultHostnameVerifier is used, as a certificate and string hostname-matching utility during WebAuthn/FIDO2 registration with an android-safetynet attestation statement.2 That usage performs no network call and never reaches the HTTP/1.1 message parser.
Outbound client usage is not attacker-reachable. Where httpcore5 does act as a client, it parses HTTP responses returned by configured endpoints. Triggering the defect would require one of those target servers to return a response with an excessive number or length of headers. As these endpoints are administrator-configured and reached over TLS, the opportunity for an unauthenticated external attacker to inject such a response is limited. Note that this argument rests on the integrity of the configured endpoints rather than on the code path being absent.
Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above. Since a clean drop-in fix exists, the bundled httpcore5 distributions will be updated to a fixed version in a future release as a hardening measure.