CVE-2026-54428¶
WSO2 Products impacted: no
Customer action required: no
REPORTED VULNERABILITY¶
Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows a remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.1
REPORTED PRODUCTS¶
- WSO2 Identity Server : 7.2.0, 7.3.0
WSO2 JUSTIFICATION¶
In WSO2 Identity Server, httpcore5 is used exclusively as an outbound HTTP client. It is never used as an inbound server transport.
No inbound exposure. The product's inbound HTTP transport is embedded Apache Tomcat. No WSO2 component starts an httpcore5/httpclient5 HTTP server for inbound calls, so the vulnerable HPACK decoder is never exposed to attacker-controlled inbound request traffic.
No exposure through the WebAuthn dependency. One copy of the library is nested inside the Yubico WebAuthn bundle, where only DefaultHostnameVerifier is used, as a certificate and string hostname-matching utility during WebAuthn/FIDO2 registration with an android-safetynet attestation statement.2 That usage performs no network call and never touches HTTP/2 or HPACK code.
Outbound client usage is not attacker-reachable. Where httpcore5 acts as a client, it defaults to HTTP/1.1, so the HTTP/2 HPACK path is not exercised in normal operation. Even over an HTTP/2 connection, triggering the defect would require a configured target server to return malicious oversized HPACK header blocks. As those endpoints are administrator-configured and reached over TLS, the opportunity for an unauthenticated external attacker to inject such a response is limited. Note that this argument rests on the integrity of the configured endpoints rather than on the code path being absent.
Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above. Since a clean drop-in fix exists, the bundled httpcore5 distributions will be updated to a fixed version in a future release as a hardening measure.