CVE-2026-49975

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49975", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-06-02T17:20:37.983Z", "datePublished": "2026-06-08T15:26:04.674Z", "dateUpdated": "2026-08-19T12:05:08.039Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache HTTP Server", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.4.67", "status": "affected", "version": "2.4.17", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Quang Luong of Calif.IO in collaboration with OpenAI Codex"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.</p><p>This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.</p><p><br></p>"}], "value": "Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.\n\nThis issue affects Apache HTTP Server: from 2.4.17 through 2.4.67."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-789", "description": "CWE-789 Memory Allocation with Excessive Size Value", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-06-08T15:26:04.674Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://httpd.apache.org/security/vulnerabilities_24.html"}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-05-26T12:00:00.000Z", "value": "reported"}, {"lang": "en", "time": "2026-05-27T12:00:00.000Z", "value": "fixed upstream in mod_h2 https://github.com/icing/mod_h2/commit/35c6e405390ed361189a82acd96675401ea5947c"}, {"lang": "en", "time": "2026-06-02T12:00:00.000Z", "value": "fixed in 2.4.x by r1934882"}, {"lang": "eng", "time": "2026-06-08T12:00:00.000Z", "value": "2.4.68 released"}], "title": "Apache HTTP Server: mod_http2 denial of service", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/06/03/3"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00009.html"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/08/16"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-08T22:32:35.729Z"}}, {"references": [{"url": "https://github.com/EQSTLab/CVE-2026-49975", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-18T10:27:36.270403Z", "id": "CVE-2026-49975", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-18T10:29:04.207Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1::el8"], "defaultStatus": "affected", "packageName": "jbcs-httpd24-httpd", "product": "JBoss Core Services for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.4.62-13.el8jbcs", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1::el8"], "defaultStatus": "affected", "packageName": "jbcs-httpd24-mod_http2", "product": "JBoss Core Services for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.29-10.el8jbcs", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1::el7"], "defaultStatus": "affected", "packageName": "jbcs-httpd24-httpd", "product": "JBoss Core Services on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.4.62-13.el7jbcs", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1::el7"], "defaultStatus": "affected", "packageName": "jbcs-httpd24-mod_http2", "product": "JBoss Core Services on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.29-10.el7jbcs", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "mod_http2", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.29-4.el10_2.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "defaultStatus": "affected", "packageName": "mod_http2", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.29-2.el10_0.2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "httpd:2.4", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260608081321.489197e6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.4"], "defaultStatus": "affected", "packageName": "httpd:2.4", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8040020260702193120.522a0ee4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus_long_life:8.4"], "defaultStatus": "affected", "packageName": "httpd:2.4", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8040020260702193120.522a0ee4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.6"], "defaultStatus": "affected", "packageName": "httpd:2.4", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260702195216.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus_long_life:8.6"], "defaultStatus": "affected", "packageName": "httpd:2.4", "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260702195216.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_tus:8.8"], "defaultStatus": "affected", "packageName": "httpd:2.4", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260702200145.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.8"], "defaultStatus": "affected", "packageName": "httpd:2.4", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260702200145.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "mod_http2", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.26-6.el9_8.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.2"], "defaultStatus": "affected", "packageName": "mod_http2", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.15.19-4.el9_2.8", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.4"], "defaultStatus": "affected", "packageName": "mod_http2", "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.26-2.el9_4.3", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "mod_http2", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.26-4.el9_6.2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "affected", "packageName": "jbcs", "product": "Red Hat JBoss Core Services 2.4.62.SP4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "httpd24-httpd", "versionType": "rpm"}, {"lessThan": "*", "status": "unaffected", "version": "httpd24-mod_http2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "httpd-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "2.4.68-1.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:service_mesh:2.6::el9"], "defaultStatus": "affected", "packageName": "openshift-service-mesh/proxyv2-rhel9", "product": "Red Hat OpenShift Service Mesh 2.6", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1781604724", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-apache-commons-daemon", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-apache-commons-daemon-jsvc", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-apr", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-apr-util", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-brotli", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-compose", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-curl", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-dist", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-jansson", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-mod_cluster-native", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-mod_jk", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-mod_md", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-mod_proxy_cluster", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-mod_security", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-nghttp2", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-openssl", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-openssl-chil", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-openssl-pkcs11", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_web_server:5"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-apr", "product": "Red Hat JBoss Web Server 5", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_web_server:5"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-openssl", "product": "Red Hat JBoss Web Server 5", "vendor": "Red Hat"}], "datePublic": "2026-06-03T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A flaw was found in HTTP/2, affecting various web servers. A remote attacker can exploit this vulnerability by combining an HPACK compression bomb with a zero-byte flow-control window. This technique allows a small amount of data to expand into large memory allocations on the server, which are then held, leading to a denial of service (DoS) by rendering the server inaccessible."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-409", "description": "Improper Handling of Highly Compressed Data (Data Amplification)", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-49975"}, {"name": "RHBZ#2485371", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485371"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49975.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:27200"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:50538"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:25225"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:25090"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:36846"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:36831"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:36373"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:55930"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:55992"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:50572"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:25057"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:25042"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:27201"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:27114"}], "solutions": [{"lang": "en", "value": "RHSA-2026:27200: Red Hat JBoss Core Services on RHEL 7 Server, Red Hat JBoss Core Services on RHEL 8"}, {"lang": "en", "value": "RHSA-2026:50538: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"}, {"lang": "en", "value": "RHSA-2026:25225: Red Hat Enterprise Linux AppStream (v. 10)"}, {"lang": "en", "value": "RHSA-2026:25090: Red Hat Enterprise Linux AppStream (v. 8)"}, {"lang": "en", "value": "RHSA-2026:36846: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"}, {"lang": "en", "value": "RHSA-2026:36831: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)"}, {"lang": "en", "value": "RHSA-2026:36373: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"}, {"lang": "en", "value": "RHSA-2026:55930: Red Hat Enterprise Linux AppStream E4S (v.9.2)"}, {"lang": "en", "value": "RHSA-2026:55992: Red Hat Enterprise Linux AppStream E4S (v.9.4)"}, {"lang": "en", "value": "RHSA-2026:50572: Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:25057: Red Hat Enterprise Linux AppStream (v. 9)"}, {"lang": "en", "value": "RHSA-2026:25042: Red Hat Hardened Images"}, {"lang": "en", "value": "RHSA-2026:27201: Red Hat JBoss Core Services 2.4.62.SP4"}, {"lang": "en", "value": "RHSA-2026:27114: Red Hat OpenShift Service Mesh 2.6"}], "timeline": [{"lang": "en", "time": "2026-06-05T06:04:44.009Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-03T00:00:00.000Z", "value": "Made public."}], "title": "httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack", "workarounds": [{"lang": "en", "value": "See the security bulletin for a detailed mitigation procedure."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-19T12:05:08.039Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/06/03/3"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00009.html"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/08/16"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-06-08T22:32:35.729Z"}}, {"title": "httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:jboss_core_services:1::el8"], "vendor": "Red Hat", "product": "JBoss Core Services for RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.4.62-13.el8jbcs", "lessThan": "*", "versionType": "rpm"}], "packageName": "jbcs-httpd24-httpd", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1::el8"], "vendor": "Red Hat", "product": "JBoss Core Services for RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.0.29-10.el8jbcs", "lessThan": "*", "versionType": "rpm"}], "packageName": "jbcs-httpd24-mod_http2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1::el7"], "vendor": "Red Hat", "product": "JBoss Core Services on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.4.62-13.el7jbcs", "lessThan": "*", "versionType": "rpm"}], "packageName": "jbcs-httpd24-httpd", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1::el7"], "vendor": "Red Hat", "product": "JBoss Core Services on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.0.29-10.el7jbcs", "lessThan": "*", "versionType": "rpm"}], "packageName": "jbcs-httpd24-mod_http2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:2.0.29-4.el10_2.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "mod_http2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:2.0.29-2.el10_0.2", "lessThan": "*", "versionType": "rpm"}], "packageName": "mod_http2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "8100020260608081321.489197e6", "lessThan": "*", "versionType": "rpm"}], "packageName": "httpd:2.4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.4"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "versions": [{"status": "unaffected", "version": "8040020260702193120.522a0ee4", "lessThan": "*", "versionType": "rpm"}], "packageName": "httpd:2.4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus_long_life:8.4"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "versions": [{"status": "unaffected", "version": "8040020260702193120.522a0ee4", "lessThan": "*", "versionType": "rpm"}], "packageName": "httpd:2.4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "versions": [{"status": "unaffected", "version": "8060020260702195216.ad008a3a", "lessThan": "*", "versionType": "rpm"}], "packageName": "httpd:2.4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus_long_life:8.6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On", "versions": [{"status": "unaffected", "version": "8060020260702195216.ad008a3a", "lessThan": "*", "versionType": "rpm"}], "packageName": "httpd:2.4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_tus:8.8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "versions": [{"status": "unaffected", "version": "8080020260702200145.63b34585", "lessThan": "*", "versionType": "rpm"}], "packageName": "httpd:2.4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:8.8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "8080020260702200145.63b34585", "lessThan": "*", "versionType": "rpm"}], "packageName": "httpd:2.4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:2.0.26-6.el9_8.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "mod_http2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.2"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:1.15.19-4.el9_2.8", "lessThan": "*", "versionType": "rpm"}], "packageName": "mod_http2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.4"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:2.0.26-2.el9_4.3", "lessThan": "*", "versionType": "rpm"}], "packageName": "mod_http2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:2.0.26-4.el9_6.2", "lessThan": "*", "versionType": "rpm"}], "packageName": "mod_http2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services 2.4.62.SP4", "versions": [{"status": "unaffected", "version": "httpd24-httpd", "lessThan": "*", "versionType": "rpm"}, {"status": "unaffected", "version": "httpd24-mod_http2", "lessThan": "*", "versionType": "rpm"}], "packageName": "jbcs", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "2.4.68-1.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "httpd-main", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:service_mesh:2.6::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Service Mesh 2.6", "versions": [{"status": "unaffected", "version": "1781604724", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-service-mesh/proxyv2-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-apache-commons-daemon", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-apache-commons-daemon-jsvc", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-apr", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-apr-util", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-brotli", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-compose", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-curl", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-dist", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-jansson", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-mod_cluster-native", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-mod_jk", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-mod_md", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-mod_proxy_cluster", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-mod_security", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-nghttp2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-openssl", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-openssl-chil", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services", "packageName": "jbcs-httpd24-openssl-pkcs11", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_web_server:5"], "vendor": "Red Hat", "product": "Red Hat JBoss Web Server 5", "packageName": "jbcs-httpd24-apr", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_web_server:5"], "vendor": "Red Hat", "product": "Red Hat JBoss Web Server 5", "packageName": "jbcs-httpd24-openssl", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-06-05T06:04:44.009Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-03T00:00:00.000Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:27200: Red Hat JBoss Core Services on RHEL 7 Server, Red Hat JBoss Core Services on RHEL 8"}, {"lang": "en", "value": "RHSA-2026:50538: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"}, {"lang": "en", "value": "RHSA-2026:25225: Red Hat Enterprise Linux AppStream (v. 10)"}, {"lang": "en", "value": "RHSA-2026:25090: Red Hat Enterprise Linux AppStream (v. 8)"}, {"lang": "en", "value": "RHSA-2026:36846: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"}, {"lang": "en", "value": "RHSA-2026:36831: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)"}, {"lang": "en", "value": "RHSA-2026:36373: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"}, {"lang": "en", "value": "RHSA-2026:55930: Red Hat Enterprise Linux AppStream E4S (v.9.2)"}, {"lang": "en", "value": "RHSA-2026:55992: Red Hat Enterprise Linux AppStream E4S (v.9.4)"}, {"lang": "en", "value": "RHSA-2026:50572: Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:25057: Red Hat Enterprise Linux AppStream (v. 9)"}, {"lang": "en", "value": "RHSA-2026:25042: Red Hat Hardened Images"}, {"lang": "en", "value": "RHSA-2026:27201: Red Hat JBoss Core Services 2.4.62.SP4"}, {"lang": "en", "value": "RHSA-2026:27114: Red Hat OpenShift Service Mesh 2.6"}], "x_adpType": "supplier", "datePublic": "2026-06-03T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-49975", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485371", "name": "RHBZ#2485371", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49975.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:27200", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:50538", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:25225", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:25090", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:36846", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:36831", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:36373", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:55930", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:55992", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:50572", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:25057", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:25042", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:27201", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:27114", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "See the security bulletin for a detailed mitigation procedure."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in HTTP/2, affecting various web servers. A remote attacker can exploit this vulnerability by combining an HPACK compression bomb with a zero-byte flow-control window. This technique allows a small amount of data to expand into large memory allocations on the server, which are then held, leading to a denial of service (DoS) by rendering the server inaccessible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-409", "description": "Improper Handling of Highly Compressed Data (Data Amplification)"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-19T12:05:08.039Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-49975", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-18T10:27:36.270403Z"}}}], "references": [{"url": "https://github.com/EQSTLab/CVE-2026-49975", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T15:25:45.811Z"}}], "cna": {"title": "Apache HTTP Server: mod_http2 denial of service", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Quang Luong of Calif.IO in collaboration with OpenAI Codex"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache HTTP Server", "versions": [{"status": "affected", "version": "2.4.17", "versionType": "semver", "lessThanOrEqual": "2.4.67"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-05-26T12:00:00.000Z", "value": "reported"}, {"lang": "en", "time": "2026-05-27T12:00:00.000Z", "value": "fixed upstream in mod_h2 https://github.com/icing/mod_h2/commit/35c6e405390ed361189a82acd96675401ea5947c"}, {"lang": "en", "time": "2026-06-02T12:00:00.000Z", "value": "fixed in 2.4.x by r1934882"}, {"lang": "eng", "time": "2026-06-08T12:00:00.000Z", "value": "2.4.68 released"}], "references": [{"url": "https://httpd.apache.org/security/vulnerabilities_24.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.\n\nThis issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.", "supportingMedia": [{"type": "text/html", "value": "<p>Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.</p><p>This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.</p><p><br></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789 Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-06-08T15:26:04.674Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49975", "state": "PUBLISHED", "dateUpdated": "2026-08-19T12:05:08.039Z", "dateReserved": "2026-06-02T17:20:37.983Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-06-08T15:26:04.674Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache HTTP Server", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.4.67", "status": "affected", "version": "2.4.17", "versionType": "semver"}]}], "source": "security@apache.org"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1::el8"], "defaultStatus": "affected", "packageName": "jbcs-httpd24-httpd", "product": "JBoss Core Services for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.4.62-13.el8jbcs", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1::el8"], "defaultStatus": "affected", "packageName": "jbcs-httpd24-mod_http2", "product": "JBoss Core Services for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.29-10.el8jbcs", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1::el7"], "defaultStatus": "affected", "packageName": "jbcs-httpd24-httpd", "product": "JBoss Core Services on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.4.62-13.el7jbcs", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1::el7"], "defaultStatus": "affected", "packageName": "jbcs-httpd24-mod_http2", "product": "JBoss Core Services on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.29-10.el7jbcs", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "mod_http2", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.29-4.el10_2.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "defaultStatus": "affected", "packageName": "mod_http2", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.29-2.el10_0.2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "httpd:2.4", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260608081321.489197e6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.4"], "defaultStatus": "affected", "packageName": "httpd:2.4", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8040020260702193120.522a0ee4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus_long_life:8.4"], "defaultStatus": "affected", "packageName": "httpd:2.4", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8040020260702193120.522a0ee4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.6"], "defaultStatus": "affected", "packageName": "httpd:2.4", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260702195216.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus_long_life:8.6"], "defaultStatus": "affected", "packageName": "httpd:2.4", "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260702195216.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_tus:8.8"], "defaultStatus": "affected", "packageName": "httpd:2.4", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260702200145.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.8"], "defaultStatus": "affected", "packageName": "httpd:2.4", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260702200145.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "mod_http2", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.26-6.el9_8.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.2"], "defaultStatus": "affected", "packageName": "mod_http2", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.15.19-4.el9_2.8", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.4"], "defaultStatus": "affected", "packageName": "mod_http2", "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.26-2.el9_4.3", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "mod_http2", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.26-4.el9_6.2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "affected", "packageName": "jbcs", "product": "Red Hat JBoss Core Services 2.4.62.SP4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "httpd24-httpd", "versionType": "rpm"}, {"lessThan": "*", "status": "unaffected", "version": "httpd24-mod_http2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "httpd-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "2.4.68-1.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:service_mesh:2.6::el9"], "defaultStatus": "affected", "packageName": "openshift-service-mesh/proxyv2-rhel9", "product": "Red Hat OpenShift Service Mesh 2.6", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1781604724", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-apache-commons-daemon", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-apache-commons-daemon-jsvc", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-apr", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-apr-util", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-brotli", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-compose", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-curl", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-dist", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-jansson", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-mod_cluster-native", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-mod_jk", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-mod_md", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-mod_proxy_cluster", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-mod_security", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-nghttp2", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-openssl", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-openssl-chil", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-openssl-pkcs11", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_web_server:5"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-apr", "product": "Red Hat JBoss Web Server 5", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_web_server:5"], "defaultStatus": "unaffected", "packageName": "jbcs-httpd24-openssl", "product": "Red Hat JBoss Web Server 5", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "DD819875-456D-45A6-90C9-4EDA544029A4", "versionEndExcluding": "2.4.68", "versionStartIncluding": "2.4.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.\n\nThis issue affects Apache HTTP Server: from 2.4.17 through 2.4.67."}, {"lang": "es", "value": "Vulnerabilidad de asignaci\u00f3n de memoria con valor de tama\u00f1o excesivo en el mod_http del Servidor HTTP Apache conduce a denegaci\u00f3n de servicio a trav\u00e9s de solicitudes HTTP maliciosas.\n\nEste problema afecta al Servidor HTTP Apache: desde 2.4.17 hasta 2.4.67."}], "id": "CVE-2026-49975", "lastModified": "2026-08-19T12:18:28.650", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49975", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-18T10:27:36.270403Z", "version": "2.0.3"}}]}, "published": "2026-06-08T16:16:44.223", "references": [{"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://httpd.apache.org/security/vulnerabilities_24.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/06/03/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/06/08/16"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00009.html"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:25042"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:25057"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:25090"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:25225"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:27114"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:27200"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:27201"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:36373"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:36831"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:36846"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:50538"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:50572"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:55930"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:55992"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-49975"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485371"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/EQSTLab/CVE-2026-49975"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49975.json"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-789"}], "source": "security@apache.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-409"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack", "id": "2485371", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485371"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-409", "details": ["A flaw was found in HTTP/2, affecting various web servers. A remote attacker can exploit this vulnerability by combining an HPACK compression bomb with a zero-byte flow-control window. This technique allows a small amount of data to expand into large memory allocations on the server, which are then held, leading to a denial of service (DoS) by rendering the server inaccessible."], "mitigation": {"lang": "en:us", "value": "There's no current mitigation for Apache's httpd server other than disabling HTTP/2 support for the VirtualHost. This is achieved by adding the following line into the configuration of a given virtual host:\n~~~\nProtocols http/1.1\n~~~\nAfter the change is in place the `httpd` service need to be restarted by running:\n~~~\nsystemctl restart httpd\n~~~\nNotice this change will force the httpd to only support HTTPv1.1 protocol."}, "name": "CVE-2026-49975", "package_state": [{"cpe": "cpe:/a:redhat:service_mesh:2", "fix_state": "Under investigation", "package_name": "openshift-service-mesh/proxyv2-rhel9", "product_name": "OpenShift Service Mesh 2"}, {"cpe": "cpe:/a:redhat:service_mesh:3", "fix_state": "Under investigation", "package_name": "openshift-service-mesh/istio-proxyv2-rhel9", "product_name": "OpenShift Service Mesh 3"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "mod_http2", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "mod_http2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "mod_http2", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "httpd", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:insights_proxy:1", "fix_state": "Affected", "package_name": "insights-proxy/insights-proxy-container-rhel9", "product_name": "Red Hat Lightspeed proxy 1"}], "public_date": "2026-06-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-49975\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49975\nhttps://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb"], "statement": "There's and important denial-of-service vulnerability affecting the Apache's `httpd` HTTP/2 protocol implementation. An unauthenticated remote attacker can exploit this flaw by combining HPACK compression with flow control manipulation, leading to significant server memory exhaustion and rendering the service inaccessible. This vulnerability exists in default HTTP/2 configurations.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.4.17,2.4.67]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "http_server", "vendor": "apache"}], "created": "2026-06-06T02:00:10.398862+00:00", "updated": "2026-10-25T19:00:18.984557+00:00", "vendors": ["apache", "apache$PRODUCT$http_server"]}