Apache HTTP Server mod_http DoS via Excessive Memory Allocation (2.4.17-2.4.67)
CVE-2026-49975 Published on June 8, 2026

Apache HTTP Server: mod_http2 denial of service
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-49975 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Timeline

reported

fixed upstream in mod_h2 https://github.com/icing/mod_h2/commit/35c6e405390ed361189a82acd96675401ea5947c 1 day later.

fixed in 2.4.x by r1934882 6 days later.

2.4.68 released 6 days later.

Weakness Types

What is a Stack Exhaustion Vulnerability?

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

CVE-2026-49975 has been classified to as a Stack Exhaustion vulnerability or weakness.

What is a Data Amplification Vulnerability?

The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.

CVE-2026-49975 has been classified to as a Data Amplification vulnerability or weakness.


Products Associated with CVE-2026-49975

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-49975 are published in these products:

Apache HTTP Server
 
Microsoft Http Server
 
Canonical Ubuntu Linux
 
F5 Networks Http Server
 
Red Hat Http Server
 
Red Hat Jboss Core Services
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Hummingbird
 
Red Hat Service Mesh
 
Red Hat Jboss Enterprise Web Server
 
Red Hat Rhel E4s
 
Red Hat Rhel Tus
 
Red Hat Rhel Aus
 
Red Hat Rhel Eus Long Life
 
Oracle
 

Affected Versions

Apache Software Foundation Apache HTTP Server: Red Hat JBoss Core Services for RHEL 8: Red Hat JBoss Core Services for RHEL 8: Red Hat JBoss Core Services on RHEL 7: Red Hat JBoss Core Services on RHEL 7: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On: Red Hat Enterprise Linux 8.8 Telecommunications Update Service: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: Red Hat Enterprise Linux 9: Red Hat JBoss Core Services 2.4.62.SP4: Red Hat Hardened Images: Red Hat OpenShift Service Mesh 2.6: Red Hat JBoss Core Services: Red Hat JBoss Core Services: Red Hat JBoss Core Services: Red Hat JBoss Core Services: Red Hat JBoss Core Services: Red Hat JBoss Core Services: Red Hat JBoss Core Services: Red Hat JBoss Core Services: Red Hat JBoss Core Services: Red Hat JBoss Core Services: Red Hat JBoss Core Services: Red Hat JBoss Core Services: Red Hat JBoss Core Services: Red Hat JBoss Core Services: Red Hat JBoss Core Services: Red Hat JBoss Core Services: Red Hat JBoss Core Services: Red Hat JBoss Core Services: Red Hat JBoss Web Server 5: Red Hat JBoss Web Server 5:

Exploit Probability

EPSS
1.31%
Percentile
66.97%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.