HttpComponents Core CVE-2026-54428

The primary remediation is to upgrade org.apache.httpcomponents.core5:httpcore5-h2 to a version that enforces the configured SETTINGS_MAX_HEADER_LIST_SIZE before the SETTINGS ACK completes. The advisory does not explicitly name a fixed release version in the provided data - the exact patched artifact version should be confirmed via the Apache HttpComponents release page at https://hc.apache.org/ and the oss-security advisory at https://seclists.org/oss-sec/2026/q3/2 before deploying. As a compensating control where an immediate upgrade is not possible, placing an HTTP/2-aware reverse proxy (such as nginx or HAProxy) in front of the affected service can apply connection-level header size limits before traffic reaches the Java application, reducing the attack surface with the trade-off of added infrastructure complexity. Additionally, applying JVM heap limits (-Xmx) and enabling crash restarts via a process supervisor will limit the blast radius of a successful exhaustion attempt but will not prevent transient service disruption. Disabling HTTP/2 entirely in the application configuration eliminates the vulnerable code path if HTTP/2 is not a business requirement, at the cost of losing multiplexing and header compression performance gains.