HeroDevs
Visit NES for Apache HttpComponents Home Page

NES for Apache HttpComponents Core 5.1.x Release Notes

2 versions

Comprehensive release notes and changelog for NES for Apache HttpComponents Core 5.1.x, including security patches, bug fixes, and feature updates across all supported versions.

Nov 3, 2026
Latest: 5.1.7
2 Patched Vulnerabilities
VEX Statements

November 2026

5.1.7

Released Nov 3, 2026
CVE-2026-54428
CVE-2026-54399
Full Version: 
5.1.5-httpcomponents-core-5.1.7

Security Fixes

  • AbstractH2StreamMultiplexer no longer lets a remote HTTP/2 peer send unbounded HPACK header lists before the local SETTINGS frame is acknowledged, applying the configured H2Config max header list size from connection start (CVE-2026-54428).
  • Http1Config no longer defaults to unlimited HTTP/1 header line length and header count, so the default HTTP/1.1 message parsers reject header lines longer than 8192 characters and messages with more than 100 headers (CVE-2026-54399).

October 2026

5.1.6

Released Oct 24, 2026
Full Version: 
5.1.5-httpcomponents-core-5.1.6

Notes

  • This release originates from the open-source Apache HttpComponents Core project forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds.
  • This is the initial supported baseline for the 5.1.x line. It is functionally identical to upstream 5.1.5, with no behavioral changes, and contains no vulnerability patches. Security fixes are delivered in subsequent releases on this line.

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.