Vulnerability · Published Jun 8, 2026 · Assigned by apache
CVE-2026-49975Apache HTTP Server: mod_http2 denial of service
High 7.5
In plain English
A high-severity security flaw in Apache HTTP Server from Apache Software Foundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 33.0% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)33.0%top 1.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | httpd | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:25090 |
| AlmaLinux:8 | httpd | 2.4.37-65.module_el8.10.0+4190+704ad79b.8 | ALSA-2026:25090 |
| AlmaLinux:8 | httpd-devel | 2.4.37-65.module_el8.10.0+4190+704ad79b.8 | ALSA-2026:25090 |
| AlmaLinux:8 | httpd-devel | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:25090 |
| AlmaLinux:8 | httpd-filesystem | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:25090 |
| AlmaLinux:8 | httpd-manual | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:25090 |
| AlmaLinux:8 | httpd-tools | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:25090 |
| AlmaLinux:8 | httpd-tools | 2.4.37-65.module_el8.10.0+4190+704ad79b.8 | ALSA-2026:25090 |
| AlmaLinux:10 | mod_http2 | 2.0.29-4.el10_2.1 | ALSA-2026:25225 |
| AlmaLinux:8 | mod_http2 | 1.15.7-10.module_el8.10.0+4190+704ad79b.6 | ALSA-2026:25090 |
| AlmaLinux:9 | mod_http2 | 2.0.26-6.el9_8.1 | ALSA-2026:25057 |
| AlmaLinux:8 | mod_ldap | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:25090 |
| AlmaLinux:8 | mod_ldap | 2.4.37-65.module_el8.10.0+4190+704ad79b.8 | ALSA-2026:25090 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.10.0+4088+57f011c1.2 | ALSA-2026:25090 |
| AlmaLinux:8 | mod_proxy_html | 1:2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:25090 |
| AlmaLinux:8 | mod_proxy_html | 1:2.4.37-65.module_el8.10.0+4190+704ad79b.8 | ALSA-2026:25090 |
| AlmaLinux:8 | mod_session | 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:25090 |
| AlmaLinux:8 | mod_session | 2.4.37-65.module_el8.10.0+4190+704ad79b.8 | ALSA-2026:25090 |
| AlmaLinux:8 | mod_ssl | 1:2.4.37-65.module_el8.10.0+4185+0955a0d7.8 | ALSA-2026:25090 |
| AlmaLinux:8 | mod_ssl | 1:2.4.37-65.module_el8.10.0+4190+704ad79b.8 | ALSA-2026:25090 |
| Alpine:v3.21 | apache2 | 2.4.68-r0 | ALPINE-CVE-2026-49975 |
| Alpine:v3.22 | apache2 | 2.4.68-r0 | ALPINE-CVE-2026-49975 |
| Alpine:v3.23 | apache2 | 2.4.68-r0 | ALPINE-CVE-2026-49975 |
| Alpine:v3.24 | apache2 | 2.4.68-r0 | ALPINE-CVE-2026-49975 |
| Alpine:v3.21 | nginx | 1.26.3-r1 | ALPINE-CVE-2026-49975 |
| Alpine:v3.22 | nginx | 1.28.3-r3 | ALPINE-CVE-2026-49975 |
| Alpine:v3.23 | nginx | 1.28.3-r3 | ALPINE-CVE-2026-49975 |
| Alpine:v3.24 | nginx | 1.30.1-r0 | ALPINE-CVE-2026-49975 |
| Debian:12 | apache2 | 2.4.67-1~deb12u3 | DEBIAN-CVE-2026-49975 |
| Debian:13 | apache2 | 2.4.67-1~deb13u3 | DEBIAN-CVE-2026-49975 |
| Debian:14 | apache2 | 2.4.67-2 | DEBIAN-CVE-2026-49975 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+40197+0231e209.8 | RLSA-2026:25090 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+40045+6ce8579b.6 | RLSA-2026:25090 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+40053+5a18018e.7 | RLSA-2026:25090 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1840+b070a976.1 | RLSA-2026:25090 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1842+4a9649e8.2 | RLSA-2026:25090 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+2061+8d03fdec.5 | RLSA-2026:25090 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1984+1bed3124.4 | RLSA-2026:25090 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1938+3b7755d4.3 | RLSA-2026:25090 |
| Rocky Linux:8 | httpd | 0:2.4.37-65.module+el8.10.0+1830+22f0c9e0 | RLSA-2026:25090 |
| Rocky Linux:10 | mod_http2 | 0:2.0.29-4.el10_2.1 | RLSA-2026:25225 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+40197+0231e209.5 | RLSA-2026:25090 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+2061+8d03fdec.4 | RLSA-2026:25090 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1883+38ed6c58.1 | RLSA-2026:25090 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1938+3b7755d4.3 | RLSA-2026:25090 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1830+22f0c9e0 | RLSA-2026:25090 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-10.module+el8.10.0+1775+6b057638 | RLSA-2026:25090 |
| Rocky Linux:9 | mod_http2 | 0:2.0.26-6.el9_8.1 | RLSA-2026:25057 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.9.0+1370+89cc8ad5 | RLSA-2026:25090 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.10.0+40053+5a18018e.2 | RLSA-2026:25090 |
| Ubuntu:22.04:LTS | apache2 | 2.4.52-1ubuntu4.21 | UBUNTU-CVE-2026-49975 |
| Ubuntu:24.04:LTS | apache2 | 2.4.58-1ubuntu8.13 | UBUNTU-CVE-2026-49975 |
| Ubuntu:25.10 | apache2 | 2.4.64-1ubuntu3.5 | UBUNTU-CVE-2026-49975 |
| Ubuntu:26.04:LTS | apache2 | 2.4.66-2ubuntu2.2 | UBUNTU-CVE-2026-49975 |
| Ubuntu:22.04:LTS | nginx | 1.18.0-6ubuntu14.15 | UBUNTU-CVE-2026-49975 |
| Ubuntu:24.04:LTS | nginx | 1.24.0-2ubuntu7.12 | UBUNTU-CVE-2026-49975 |
| Ubuntu:25.10 | nginx | 1.28.0-6ubuntu1.7 | UBUNTU-CVE-2026-49975 |
| Ubuntu:26.04:LTS | nginx | 1.28.3-2ubuntu1.5 | UBUNTU-CVE-2026-49975 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache HTTP Server | 2.4.17 – through 2.4.67 |
Weakness: CWE-789, CWE-409 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://httpd.apache.org/security/vulnerabilities_24.html vendor-advisory
- http://www.openwall.com/lists/oss-security/2026/06/03/3
- https://lists.debian.org/debian-lts-announce/2026/06/msg00009.html
- http://www.openwall.com/lists/oss-security/2026/06/08/16
- https://github.com/EQSTLab/CVE-2026-49975 exploit
- https://access.redhat.com/security/cve/CVE-2026-49975 vdb-entry, x_refsource_REDHAT
- RHBZ#2485371 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49975.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:27200 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50538 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25225 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25090 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36846 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36831 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36373 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:55930 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:55992 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50572 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25057 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25042 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27201 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27114 vendor-advisory, x_refsource_REDHAT