CVE-2026-49975
Apache HTTP Server: mod_http2 denial of service
HIGH 7.5EPSS 4.2%
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
- Affected
- Apache Software Foundation · Apache HTTP Server
- CVSS v3.1 CNA
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- 4.17% chance of exploitation in the next 30 days, 91st percentile
- Published
- 2026-06-08
- Updated
- 2026-08-19
Proof-of-concept exploits (12)
- mrx-arafat/CVE-2026-49975-POC29★ · 2026-06-04
- EQSTLab/CVE-2026-4997514★ · 2026-06-25
- LiaoZiqi-GZFLS/CVE-2026-499753★ · 2026-06-10
- fevar54/Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-6★ · 2026-06-03
- LSG-PolarBear/CVE-2026-499756★ · 2026-06-11
- renzi25031469/CVE-2026-49975-HTTP-2-Bomb2★ · 2026-06-08
- razureink/cve-2026-49975-http2bomb_reproduction2★ · 2026-07-23
- 0xc03307b/CVE-2026-499750★ · 2026-06-18
- Manisso/http2-bomb0★ · 2026-07-05
- SHIYUE2/2026-49975libraryattackmod0★ · 2026-06-18
- naheeju/POC-CVE-2026-499753★ · 2026-09-16
- yym8538/CVE-2026-499751★ · 2026-08-21
Security advisories
- https://httpd.apache.org/security/vulnerabilities_24.html
- http://www.openwall.com/lists/oss-security/2026/06/03/3
- http://www.openwall.com/lists/oss-security/2026/06/08/16
- https://lists.debian.org/debian-lts-announce/2026/06/msg00009.html