CVE-2026-49975

HIGH 7.5EPSS 31.0%

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

CVSS v3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 31.04% chance of exploitation in the next 30 days, 98th percentile
Published: 2026-06-08
Updated: 2026-08-19

Proof-of-concept exploits (10)

mrx-arafat/CVE-2026-49975-POC29★ · 2026-06-04
EQSTLab/CVE-2026-4997514★ · 2026-06-25
LiaoZiqi-GZFLS/CVE-2026-499753★ · 2026-06-10
fevar54/Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-6★ · 2026-06-03
LSG-PolarBear/CVE-2026-499756★ · 2026-06-11
renzi25031469/CVE-2026-49975-HTTP-2-Bomb2★ · 2026-06-08
razureink/cve-2026-49975-http2bomb_reproduction2★ · 2026-07-23
0xc03307b/CVE-2026-499750★ · 2026-06-18
Manisso/http2-bomb0★ · 2026-07-05
SHIYUE2/2026-49975libraryattackmod

References

Related