CVE-2026-49975 is a denial of service vulnerability in the Apache HTTP Server's HTTP/2 protocol implementation (mod_http2). The flaw allows an unauthenticated remote attacker to cause excessive memory allocation by combining an HPACK compression bomb with a zero-byte flow-control window. This technique amplifies a small amount of data into large memory allocations that are held by the server, exhausting system memory and rendering the server inaccessible. The vulnerability exists in default HTTP/2 configurations and affects Apache HTTP Server versions from 2.4.17 through 2.4.67. Red Hat's advisory confirms the issue and rates it as Important, providing security updates in JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4. The CVSS v3.1 base score is 7.5 (High), with no impact on confidentiality or integrity but high impact on availability. No known exploits in the wild have been reported at this time.

The vulnerability leads to a denial of service condition by exhausting server memory resources through amplified memory allocation triggered by malicious HTTP/2 requests. This results in degraded system performance or complete service unavailability. There is no impact on confidentiality or integrity of data. The attack requires no privileges or user interaction and can be performed remotely over the network.

A security update addressing this vulnerability is available from Red Hat in the JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 release. Users should apply this update to remediate the issue. The vulnerability exists in default HTTP/2 configurations; therefore, disabling HTTP/2 or applying vendor-recommended mitigations may reduce exposure if immediate patching is not possible. Refer to the Red Hat security bulletin (RHSA-2026:27200) and Apache advisories for detailed mitigation procedures. No indication that the vulnerability is already mitigated without patching.