From 0cf0e8b76aa8c28810e1a5ae2a3a2a88505f9db4 Mon Sep 17 00:00:00 2001
From: Chaitanya Bhorade <bhoradc@amazon.com>
Date: Thu, 9 Jul 2026 15:13:50 -0700
Subject: [PATCH] feat(apache5-client): Upgrade httpcomponents.client5 to 5.6.2

Upgrade httpclient5 from 5.6.1 to 5.6.2 to resolve CVE-2026-54428
(CWE-770: Allocation of Resources Without Limits or Throttling) in
the transitive dependency httpcore5-h2. The vulnerability allows a
remote attacker to exhaust memory via oversized HTTP/2 HPACK header
blocks before SETTINGS ACK applies the configured limit.

httpclient5 5.6.2 pulls in httpcore5-h2 5.4.3 which contains the fix.

Fixes https://github.com/aws/aws-sdk-java-v2/issues/7123
---
 .../next-release/feature-ApacheHTTPClient5-9937320.json     | 6 ++++++
 pom.xml                                                     | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)
 create mode 100644 .changes/next-release/feature-ApacheHTTPClient5-9937320.json

diff --git a/.changes/next-release/feature-ApacheHTTPClient5-9937320.json b/.changes/next-release/feature-ApacheHTTPClient5-9937320.json
new file mode 100644
index 000000000000..d61cb27e012f
--- /dev/null
+++ b/.changes/next-release/feature-ApacheHTTPClient5-9937320.json
@@ -0,0 +1,6 @@
+{
+    "type": "feature",
+    "category": "Apache HTTP Client 5",
+    "contributor": "",
+    "description": "Upgrade httpcomponents.client5 to 5.6.2 to address CVE-2026-54428"
+}
diff --git a/pom.xml b/pom.xml
index a6f98e12a30a..134c4f07b4b1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -189,7 +189,7 @@
         <jre.version>1.8</jre.version>
         <httpcomponents.httpclient.version>4.5.13</httpcomponents.httpclient.version>
         <httpcomponents.httpcore.version>4.4.16</httpcomponents.httpcore.version>
-        <httpcomponents.client5.version>5.6.1</httpcomponents.client5.version>
+        <httpcomponents.client5.version>5.6.2</httpcomponents.client5.version>
         <httpcomponents.core5.version>5.4.3</httpcomponents.core5.version>
         <!-- Reactive Streams version -->
         <reactive-streams.version>1.0.4</reactive-streams.version>