^pkg:maven/org\.(apache|gov4j\.thirdparty\.org\.apache)\.httpcomponents/httpcore(\-[a-z]+)?@.*$ CVE-2026-54399 CVE-2026-54428