A flaw in the HTTP/1.1 message parser of Apache HttpComponents Core allows a remote attacker to send requests containing an excessive number of headers or header lines that are very long values, and the unbounded length can cause the application to consume large amounts of heap space, leading to crashes, freezes, or a complete denial of service. The weakness is catalogued as CWE-400, representing uncontrolled resource consumption.

The affected component is Apache HttpComponents Core library, versions 5.4.2 and earlier, and 5.5-beta1 and earlier. Based on the description, it may be embedded in Java web servers, application servers, and HTTP client frameworks that accept external requests; therefore any exposed endpoint that relies on the library could be a potential attack surface.

The CVSS score of 7.5 indicates high severity, while the EPSS score of < 1% signals a low probability of real-world exploitation. The vulnerability is not listed in CISA KEV. A remote attacker can trigger the flaw by sending crafted HTTP requests to any endpoint that uses the library. The description suggests that no authentication or privileged access is required. The attack surface likely exists wherever the library parses inbound HTTP traffic.