The vulnerability resides in the HPackDecoder the configured limit on the header list size is not enforced until after the HTTP 2 SETTINGS acknowledgment is received. A remote attacker can therefore send an oversized compressed header block that forces the decoder to allocate memory without bounds, leading to memory exhaustion. This unbounded consumption can crash the application or the underlying host, resulting in a denial‑of‑service.

Apache HttpComponents Core versions 5.4.2 and earlier, as well as 5.5-beta1 and earlier, are affected. Any software that incorporates one of these releases and processes HTTP 2 traffic is at risk.

The CVSS score of 7.5 indicates a high‑severity vulnerability, while the EPSS score of < 1% indicates that the likelihood of exploitation is low but not impossible. The vulnerability is not in the CISA KEV catalog. Based on the description, an attacker would need to initiate an HTTP 2 connection and send crafted frames containing oversized header blocks before the SETTINGS acknowledgment is received vector a remote network‑based request over HTTP 2.