This vulnerability (CVE-2026-49975) involves a memory allocation with an excessive size value in the Apache HTTP Server's mod_http2 module, which can be exploited by sending specially crafted HTTP/2 requests. The flaw leads to denial of service by causing the server to allocate excessive memory, resulting in service disruption. The affected versions are Apache HTTP Server from 2.4.17 through 2.4.67. Red Hat's advisory for JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 includes a fix for this issue, along with other related vulnerabilities. The patch addresses the excessive memory allocation and prevents the denial of service condition. No known exploits in the wild have been reported at this time.

Successful exploitation of this vulnerability results in denial of service (DoS) by causing the Apache HTTP Server to allocate excessive memory, which can disrupt availability of the web service. There is no impact on confidentiality or integrity reported. The CVSS v3.1 base score is 7.5 (high), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

A security update addressing CVE-2026-49975 is available from Red Hat as part of the JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 release. Applying this official patch will remediate the vulnerability. Users should ensure all relevant errata are applied before updating. No additional mitigations are stated in the vendor advisory. Patch status is confirmed by the Red Hat advisory; therefore, applying the update is the recommended remediation.