CVE-2026-49975
CVE-2026-49975 · Apache HTTP Server: mod_http2 denial of service
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
CVSS 7.5 · High · EPSS 4.2% · Fix available
- Published
- Updated
Affected products and versions
apache httpd
- Versions
- ≥ 2.4.17, ≤ 2.4.67: Affected (semver)
No fix published
apache2 Debian:12
- Versions
- 2.4.57-2
- 2.4.57-3
- 2.4.58-1
- 2.4.59-1
- 2.4.59-1~deb10u1
- 2.4.59-1~deb11u1
- 2.4.59-1~deb12u1
- 2.4.59-2
- 2.4.60-1
- 2.4.61-1
- 2.4.61-1~deb11u1
- 2.4.61-1~deb12u1
- 2.4.62-1
- 2.4.62-1~deb11u1
- 2.4.62-1~deb11u2
- 2.4.62-1~deb12u1
- 2.4.62-1~deb12u2
- 2.4.62-2
- 2.4.62-3
- 2.4.62-4
- 2.4.62-5
- 2.4.62-6
- 2.4.63-1
- 2.4.64-1
- 2.4.65-1
- 2.4.65-1~deb11u1
- 2.4.65-1~deb12u1
- 2.4.65-2
- 2.4.65-3
- 2.4.66-1
- 2.4.66-1~deb11u1
- 2.4.66-1~deb12u1
- 2.4.66-1~deb12u2
- 2.4.66-1~deb13u1
- 2.4.66-1~deb13u2
- 2.4.66-2
- 2.4.66-3
- 2.4.66-4
- 2.4.66-5
- 2.4.66-6
- 2.4.66-7
- 2.4.66-8
- 2.4.67-1~deb11u1
- 2.4.67-1~deb11u2
- 2.4.67-1~deb11u3
- 2.4.67-1~deb12u1
- 2.4.67-1~deb12u2
- Affected ranges
- ECOSYSTEM: < 2.4.67-1~deb12u3
Update to 2.4.67-1~deb12u3
apache2 Debian:13
- Versions
- 2.4.65-2
- 2.4.65-3
- 2.4.66-1
- 2.4.66-1~deb11u1
- 2.4.66-1~deb12u1
- 2.4.66-1~deb12u2
- 2.4.66-1~deb13u1
- 2.4.66-1~deb13u2
- 2.4.66-2
- 2.4.66-3
- 2.4.66-4
- 2.4.66-5
- 2.4.66-6
- 2.4.66-7
- 2.4.66-8
- 2.4.67-1~deb11u1
- 2.4.67-1~deb11u2
- 2.4.67-1~deb11u3
- 2.4.67-1~deb12u1
- 2.4.67-1~deb12u2
- 2.4.67-1~deb12u3
- 2.4.67-1~deb13u1
- 2.4.67-1~deb13u2
- Affected ranges
- ECOSYSTEM: < 2.4.67-1~deb13u3
Update to 2.4.67-1~deb13u3
apache2 Debian:14
- Versions
- 2.4.65-2
- 2.4.65-3
- 2.4.66-1
- 2.4.66-1~deb11u1
- 2.4.66-1~deb12u1
- 2.4.66-1~deb12u2
- 2.4.66-1~deb13u1
- 2.4.66-1~deb13u2
- 2.4.66-2
- 2.4.66-3
- 2.4.66-4
- 2.4.66-5
- 2.4.66-6
- 2.4.66-7
- 2.4.66-8
- 2.4.67-1
- 2.4.67-1~deb11u1
- 2.4.67-1~deb11u2
- 2.4.67-1~deb11u3
- 2.4.67-1~deb12u1
- 2.4.67-1~deb12u2
- 2.4.67-1~deb12u3
- 2.4.67-1~deb13u1
- 2.4.67-1~deb13u2
- 2.4.67-1~deb13u3
- Affected ranges
- ECOSYSTEM: < 2.4.67-2
Update to 2.4.67-2
nginx Ubuntu:Pro:14.04:LTS
- Versions
- 1.4.1-3ubuntu1
- 1.4.3-2ubuntu1
- 1.4.4-1ubuntu1
- 1.4.4-2ubuntu1
- 1.4.4-4ubuntu1
- 1.4.5-1ubuntu1
- 1.4.6-1ubuntu2
- 1.4.6-1ubuntu3
- 1.4.6-1ubuntu3.1
- 1.4.6-1ubuntu3.2
- 1.4.6-1ubuntu3.3
- 1.4.6-1ubuntu3.4
- 1.4.6-1ubuntu3.5
- 1.4.6-1ubuntu3.6
- 1.4.6-1ubuntu3.7
- 1.4.6-1ubuntu3.8
- 1.4.6-1ubuntu3.9
- 1.4.6-1ubuntu3.9+esm1
- 1.4.6-1ubuntu3.9+esm2
- 1.4.6-1ubuntu3.9+esm3
- 1.4.6-1ubuntu3.9+esm4
- 1.4.6-1ubuntu3.9+esm5
- 1.4.6-1ubuntu3.9+esm6
- Affected ranges
- ECOSYSTEM: < 1.4.6-1ubuntu3.9+esm8
Update to 1.4.6-1ubuntu3.9+esm8
apache2 Ubuntu:Pro:16.04:LTS
- Versions
- 2.4.12-2ubuntu2
- 2.4.17-1ubuntu1
- 2.4.17-2ubuntu1
- 2.4.17-3ubuntu1
- 2.4.18-1ubuntu1
- 2.4.18-2ubuntu1
- 2.4.18-2ubuntu2
- 2.4.18-2ubuntu3
- 2.4.18-2ubuntu3.1
- 2.4.18-2ubuntu3.2
- 2.4.18-2ubuntu3.3
- 2.4.18-2ubuntu3.4
- 2.4.18-2ubuntu3.5
- 2.4.18-2ubuntu3.7
- 2.4.18-2ubuntu3.8
- 2.4.18-2ubuntu3.9
- 2.4.18-2ubuntu3.10
- 2.4.18-2ubuntu3.12
- 2.4.18-2ubuntu3.13
- 2.4.18-2ubuntu3.14
- 2.4.18-2ubuntu3.15
- 2.4.18-2ubuntu3.17
- 2.4.18-2ubuntu3.17+esm1
- 2.4.18-2ubuntu3.17+esm2
- 2.4.18-2ubuntu3.17+esm3
- 2.4.18-2ubuntu3.17+esm4
- 2.4.18-2ubuntu3.17+esm5
- 2.4.18-2ubuntu3.17+esm6
- 2.4.18-2ubuntu3.17+esm7
- 2.4.18-2ubuntu3.17+esm8
- 2.4.18-2ubuntu3.17+esm9
- 2.4.18-2ubuntu3.17+esm10
- 2.4.18-2ubuntu3.17+esm11
- 2.4.18-2ubuntu3.17+esm12
- 2.4.18-2ubuntu3.17+esm13
- 2.4.18-2ubuntu3.17+esm14
- 2.4.18-2ubuntu3.17+esm16
- 2.4.18-2ubuntu3.17+esm17
- 2.4.18-2ubuntu3.17+esm18
- Affected ranges
- ECOSYSTEM: < 2.4.18-2ubuntu3.17+esm19
Update to 2.4.18-2ubuntu3.17+esm19
nginx Ubuntu:Pro:16.04:LTS
- Versions
- 1.9.3-1ubuntu1
- 1.9.6-2ubuntu1
- 1.9.6-2ubuntu2
- 1.9.9-0ubuntu1
- 1.9.9-1ubuntu1
- 1.9.10-0ubuntu1
- 1.9.10-1ubuntu1
- 1.9.11-0ubuntu1
- 1.9.11-0ubuntu2
- 1.9.12-0ubuntu1
- 1.9.13-0ubuntu1
- 1.9.14-0ubuntu1
- 1.9.15-0ubuntu1
- 1.10.0-0ubuntu0.16.04.1
- 1.10.0-0ubuntu0.16.04.2
- 1.10.0-0ubuntu0.16.04.3
- 1.10.0-0ubuntu0.16.04.4
- 1.10.3-0ubuntu0.16.04.1
- 1.10.3-0ubuntu0.16.04.2
- 1.10.3-0ubuntu0.16.04.3
- 1.10.3-0ubuntu0.16.04.4
- 1.10.3-0ubuntu0.16.04.5
- 1.10.3-0ubuntu0.16.04.5+esm1
- 1.10.3-0ubuntu0.16.04.5+esm2
- 1.10.3-0ubuntu0.16.04.5+esm3
- 1.10.3-0ubuntu0.16.04.5+esm4
- 1.10.3-0ubuntu0.16.04.5+esm5
- 1.10.3-0ubuntu0.16.04.5+esm6
- 1.10.3-0ubuntu0.16.04.5+esm7
- Affected ranges
- ECOSYSTEM: < 1.10.3-0ubuntu0.16.04.5+esm9
Update to 1.10.3-0ubuntu0.16.04.5+esm9
apache2 Ubuntu:Pro:18.04:LTS
- Versions
- 2.4.27-2ubuntu3
- 2.4.29-1ubuntu1
- 2.4.29-1ubuntu2
- 2.4.29-1ubuntu3
- 2.4.29-1ubuntu4
- 2.4.29-1ubuntu4.1
- 2.4.29-1ubuntu4.2
- 2.4.29-1ubuntu4.3
- 2.4.29-1ubuntu4.4
- 2.4.29-1ubuntu4.5
- 2.4.29-1ubuntu4.6
- 2.4.29-1ubuntu4.7
- 2.4.29-1ubuntu4.8
- 2.4.29-1ubuntu4.10
- 2.4.29-1ubuntu4.11
- 2.4.29-1ubuntu4.12
- 2.4.29-1ubuntu4.13
- 2.4.29-1ubuntu4.14
- 2.4.29-1ubuntu4.16
- 2.4.29-1ubuntu4.17
- 2.4.29-1ubuntu4.18
- 2.4.29-1ubuntu4.19
- 2.4.29-1ubuntu4.20
- 2.4.29-1ubuntu4.21
- 2.4.29-1ubuntu4.22
- 2.4.29-1ubuntu4.23
- 2.4.29-1ubuntu4.24
- 2.4.29-1ubuntu4.25
- 2.4.29-1ubuntu4.26
- 2.4.29-1ubuntu4.27
- 2.4.29-1ubuntu4.27+esm1
- 2.4.29-1ubuntu4.27+esm2
- 2.4.29-1ubuntu4.27+esm3
- 2.4.29-1ubuntu4.27+esm4
- 2.4.29-1ubuntu4.27+esm6
- 2.4.29-1ubuntu4.27+esm7
- 2.4.29-1ubuntu4.27+esm8
- 2.4.29-1ubuntu4.27+esm9
- Affected ranges
- ECOSYSTEM: < 2.4.29-1ubuntu4.27+esm10
Update to 2.4.29-1ubuntu4.27+esm10
nginx Ubuntu:Pro:18.04:LTS
- Versions
- 1.12.1-0ubuntu2
- 1.13.6-2ubuntu1
- 1.13.6-2ubuntu2
- 1.13.10-1ubuntu1
- 1.13.12-0ubuntu1
- 1.14.0-0ubuntu1
- 1.14.0-0ubuntu1.1
- 1.14.0-0ubuntu1.2
- 1.14.0-0ubuntu1.3
- 1.14.0-0ubuntu1.4
- 1.14.0-0ubuntu1.5
- 1.14.0-0ubuntu1.6
- 1.14.0-0ubuntu1.7
- 1.14.0-0ubuntu1.9
- 1.14.0-0ubuntu1.10
- 1.14.0-0ubuntu1.11
- 1.14.0-0ubuntu1.11+esm1
- 1.14.0-0ubuntu1.11+esm2
- Affected ranges
- ECOSYSTEM: < 1.14.0-0ubuntu1.11+esm4
Update to 1.14.0-0ubuntu1.11+esm4
apache2 Ubuntu:Pro:20.04:LTS
- Versions
- 2.4.41-1ubuntu1
- 2.4.41-4ubuntu1
- 2.4.41-4ubuntu2
- 2.4.41-4ubuntu3
- 2.4.41-4ubuntu3.1
- 2.4.41-4ubuntu3.3
- 2.4.41-4ubuntu3.4
- 2.4.41-4ubuntu3.5
- 2.4.41-4ubuntu3.6
- 2.4.41-4ubuntu3.7
- 2.4.41-4ubuntu3.8
- 2.4.41-4ubuntu3.9
- 2.4.41-4ubuntu3.10
- 2.4.41-4ubuntu3.11
- 2.4.41-4ubuntu3.12
- 2.4.41-4ubuntu3.13
- 2.4.41-4ubuntu3.14
- 2.4.41-4ubuntu3.15
- 2.4.41-4ubuntu3.16
- 2.4.41-4ubuntu3.17
- 2.4.41-4ubuntu3.19
- 2.4.41-4ubuntu3.20
- 2.4.41-4ubuntu3.21
- 2.4.41-4ubuntu3.23
- 2.4.41-4ubuntu3.23+esm2
- 2.4.41-4ubuntu3.23+esm3
- 2.4.41-4ubuntu3.23+esm4
- Affected ranges
- ECOSYSTEM: < 2.4.41-4ubuntu3.23+esm5
Update to 2.4.41-4ubuntu3.23+esm5
nginx Ubuntu:Pro:20.04:LTS
- Versions
- 1.16.1-0ubuntu2
- 1.16.1-0ubuntu3
- 1.17.5-0ubuntu1
- 1.17.6-0ubuntu1
- 1.17.7-0ubuntu1
- 1.17.8-0ubuntu1
- 1.17.8-0ubuntu2
- 1.17.8-0ubuntu3
- 1.17.9-0ubuntu1
- 1.17.9-0ubuntu2
- 1.17.9-0ubuntu3
- 1.17.10-0ubuntu1
- 1.18.0-0ubuntu1
- 1.18.0-0ubuntu1.2
- 1.18.0-0ubuntu1.3
- 1.18.0-0ubuntu1.4
- 1.18.0-0ubuntu1.5
- 1.18.0-0ubuntu1.6
- 1.18.0-0ubuntu1.7
- 1.18.0-0ubuntu1.7+esm1
- Affected ranges
- ECOSYSTEM: < 1.18.0-0ubuntu1.7+esm3
Update to 1.18.0-0ubuntu1.7+esm3
apache2 Ubuntu:22.04:LTS
- Versions
- 2.4.48-3.1ubuntu3
- 2.4.48-3.1ubuntu4
- 2.4.51-2ubuntu1
- 2.4.52-1ubuntu1
- 2.4.52-1ubuntu2
- 2.4.52-1ubuntu4
- 2.4.52-1ubuntu4.1
- 2.4.52-1ubuntu4.2
- 2.4.52-1ubuntu4.3
- 2.4.52-1ubuntu4.4
- 2.4.52-1ubuntu4.5
- 2.4.52-1ubuntu4.6
- 2.4.52-1ubuntu4.7
- 2.4.52-1ubuntu4.8
- 2.4.52-1ubuntu4.9
- 2.4.52-1ubuntu4.10
- 2.4.52-1ubuntu4.11
- 2.4.52-1ubuntu4.12
- 2.4.52-1ubuntu4.13
- 2.4.52-1ubuntu4.14
- 2.4.52-1ubuntu4.15
- 2.4.52-1ubuntu4.16
- 2.4.52-1ubuntu4.18
- 2.4.52-1ubuntu4.19
- 2.4.52-1ubuntu4.20
- Affected ranges
- ECOSYSTEM: < 2.4.52-1ubuntu4.21
Update to 2.4.52-1ubuntu4.21
nginx Ubuntu:22.04:LTS
- Versions
- 1.18.0-6ubuntu11
- 1.18.0-6ubuntu12
- 1.18.0-6ubuntu14
- 1.18.0-6ubuntu14.1
- 1.18.0-6ubuntu14.2
- 1.18.0-6ubuntu14.3
- 1.18.0-6ubuntu14.4
- 1.18.0-6ubuntu14.5
- 1.18.0-6ubuntu14.6
- 1.18.0-6ubuntu14.7
- 1.18.0-6ubuntu14.8
- 1.18.0-6ubuntu14.10
- 1.18.0-6ubuntu14.11
- 1.18.0-6ubuntu14.12
- 1.18.0-6ubuntu14.13
- 1.18.0-6ubuntu14.14
- Affected ranges
- ECOSYSTEM: < 1.18.0-6ubuntu14.15
Update to 1.18.0-6ubuntu14.15
apache2 Ubuntu:24.04:LTS
- Versions
- 2.4.57-2ubuntu2
- 2.4.57-2ubuntu3
- 2.4.58-1ubuntu1
- 2.4.58-1ubuntu2
- 2.4.58-1ubuntu6
- 2.4.58-1ubuntu7
- 2.4.58-1ubuntu8
- 2.4.58-1ubuntu8.1
- 2.4.58-1ubuntu8.2
- 2.4.58-1ubuntu8.3
- 2.4.58-1ubuntu8.4
- 2.4.58-1ubuntu8.5
- 2.4.58-1ubuntu8.6
- 2.4.58-1ubuntu8.7
- 2.4.58-1ubuntu8.8
- 2.4.58-1ubuntu8.10
- 2.4.58-1ubuntu8.11
- 2.4.58-1ubuntu8.12
- Affected ranges
- ECOSYSTEM: < 2.4.58-1ubuntu8.13
Update to 2.4.58-1ubuntu8.13
nginx Ubuntu:24.04:LTS
- Versions
- 1.24.0-1ubuntu1
- 1.24.0-2ubuntu1
- 1.24.0-2ubuntu2
- 1.24.0-2ubuntu3
- 1.24.0-2ubuntu4
- 1.24.0-2ubuntu6
- 1.24.0-2ubuntu7
- 1.24.0-2ubuntu7.1
- 1.24.0-2ubuntu7.3
- 1.24.0-2ubuntu7.4
- 1.24.0-2ubuntu7.5
- 1.24.0-2ubuntu7.6
- 1.24.0-2ubuntu7.7
- 1.24.0-2ubuntu7.8
- 1.24.0-2ubuntu7.9
- 1.24.0-2ubuntu7.10
- 1.24.0-2ubuntu7.11
- Affected ranges
- ECOSYSTEM: < 1.24.0-2ubuntu7.12
Update to 1.24.0-2ubuntu7.12
apache2 Ubuntu:25.10
- Versions
- 2.4.63-1ubuntu1
- 2.4.63-1ubuntu3
- 2.4.64-1ubuntu2
- 2.4.64-1ubuntu3
- 2.4.64-1ubuntu3.2
- 2.4.64-1ubuntu3.3
- 2.4.64-1ubuntu3.4
- Affected ranges
- ECOSYSTEM: < 2.4.64-1ubuntu3.5
Update to 2.4.64-1ubuntu3.5
nginx Ubuntu:25.10
- Versions
- 1.26.3-2ubuntu1
- 1.26.3-3ubuntu1
- 1.26.3-3ubuntu2
- 1.26.3-3ubuntu3
- 1.28.0-3ubuntu1
- 1.28.0-4ubuntu1
- 1.28.0-6ubuntu1
- 1.28.0-6ubuntu1.1
- 1.28.0-6ubuntu1.2
- 1.28.0-6ubuntu1.3
- 1.28.0-6ubuntu1.4
- 1.28.0-6ubuntu1.5
- 1.28.0-6ubuntu1.6
- Affected ranges
- ECOSYSTEM: < 1.28.0-6ubuntu1.7
Update to 1.28.0-6ubuntu1.7
apache2 Ubuntu:26.04:LTS
- Versions
- 2.4.64-1ubuntu3
- 2.4.65-3ubuntu1
- 2.4.66-2ubuntu1
- 2.4.66-2ubuntu2
- 2.4.66-2ubuntu2.1
- Affected ranges
- ECOSYSTEM: < 2.4.66-2ubuntu2.2
Update to 2.4.66-2ubuntu2.2
nginx Ubuntu:26.04:LTS
- Versions
- 1.28.0-6ubuntu1
- 1.28.1-2ubuntu1
- 1.28.1-3ubuntu1
- 1.28.2-2ubuntu1
- 1.28.3-2ubuntu1
- 1.28.3-2ubuntu1.1
- 1.28.3-2ubuntu1.2
- 1.28.3-2ubuntu1.3
- 1.28.3-2ubuntu1.4
- Affected ranges
- ECOSYSTEM: < 1.28.3-2ubuntu1.5
Update to 1.28.3-2ubuntu1.5
Original sources
- https://httpd.apache.org/security/vulnerabilities_24.html
- http://www.openwall.com/lists/oss-security/2026/06/03/3
- https://lists.debian.org/debian-lts-announce/2026/06/msg00009.html
- http://www.openwall.com/lists/oss-security/2026/06/08/16
- https://github.com/EQSTLab/CVE-2026-49975
- https://access.redhat.com/security/cve/CVE-2026-49975
- https://bugzilla.redhat.com/show_bug.cgi?id=2485371
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49975.json
- https://access.redhat.com/errata/RHSA-2026:27200
- https://access.redhat.com/errata/RHSA-2026:50538
- https://access.redhat.com/errata/RHSA-2026:25225
- https://access.redhat.com/errata/RHSA-2026:25090
- https://access.redhat.com/errata/RHSA-2026:36846
- https://access.redhat.com/errata/RHSA-2026:36831
- https://access.redhat.com/errata/RHSA-2026:36373
- https://access.redhat.com/errata/RHSA-2026:55930
- https://access.redhat.com/errata/RHSA-2026:55992
- https://access.redhat.com/errata/RHSA-2026:50572
- https://access.redhat.com/errata/RHSA-2026:25057
- https://access.redhat.com/errata/RHSA-2026:25042
- https://access.redhat.com/errata/RHSA-2026:27201
- https://access.redhat.com/errata/RHSA-2026:27114
- https://nvd.nist.gov/vuln/detail/CVE-2026-49975