CVE-2026-54428 and CVE-2026-54399

[psteveibm]

Hi team,

A client is reporting their vulnerability scanner has picked up two CVE (CVE-2026-54428 and CVE-2026-54399) in the IBM COS SDK for Java in Apache HTTPComponents Core 4.4.16.

Please can you take a look and advise if there will an update to fix this? Thanks!

[anurag-babal-ibm]

@psteveibm Thanks for reporting.

We're looking into it and will share an update here if and when an update is released to address the issue.