Apache HttpComponents Core EUVD-2026-41094

Upgrade Apache HttpComponents Core to a fixed release above the affected ranges - i.e. beyond 5.4.2 on the stable line and past 5.5-beta1 on the 5.5 line; the input does not specify the exact patched version number, so consult the Apache HttpComponents advisory (https://hc.apache.org/) and the oss-security post (https://seclists.org/oss-sec/2026/q3/3) for the precise release, and treat this as patch-available-per-vendor-advisory rather than an independently confirmed fixed version. Because HttpCore is typically a transitive dependency of HttpClient and application frameworks, update the transitive version via your build (Maven/Gradle) rather than only the top-level library. Where immediate upgrade is not possible, place a reverse proxy or WAF in front of the service and enforce limits on the number of request headers and maximum header size (for example cap total header bytes and header count), and rate-limit or drop oversized requests before they reach the Java service; the trade-off is that overly tight header limits can break legitimate clients that send large cookie or authorization headers, so tune thresholds against real traffic.