Detections
Analytics

CVE-2026-49975

high

Description

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

References

https://lists.debian.org/debian-lts-announce/2026/06/msg00009.html

https://httpd.apache.org/security/vulnerabilities_24.html

http://www.openwall.com/lists/oss-security/2026/06/08/16

http://www.openwall.com/lists/oss-security/2026/06/03/3

https://www.securityweek.com/citrix-patches-netscaler-vulnerabilities-including-new-http-2-bomb-attack/

https://www.darkreading.com/vulnerabilities-threats/http-2-bomb-attacks-telcos-healthcare

https://www.theregister.com/security/2026/06/04/openais-codex-chains-decade-old-dos-techniques-into-http/2-bomb/5251377

https://www.bleepingcomputer.com/news/security/new-http-2-bomb-dos-attack-crashes-web-servers-in-under-a-minute/

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49975.json

https://bugzilla.redhat.com/show_bug.cgi?id=2485371

https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb

https://access.redhat.com/security/cve/CVE-2026-49975

https://access.redhat.com/errata/RHSA-2026:36846

https://access.redhat.com/errata/RHSA-2026:36831

https://access.redhat.com/errata/RHSA-2026:36373

https://access.redhat.com/errata/RHSA-2026:27201

https://access.redhat.com/errata/RHSA-2026:27200

https://access.redhat.com/errata/RHSA-2026:27114

https://access.redhat.com/errata/RHSA-2026:25225

https://access.redhat.com/errata/RHSA-2026:25090

https://access.redhat.com/errata/RHSA-2026:25057

https://access.redhat.com/errata/RHSA-2026:25042

Details

Source: Mitre, NVD

Published: 2026-06-08

Updated: 2026-07-09

Named Vulnerability: HTTP/2 Bomb

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity: High

CVSS v4

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00018