Red Hat Security Advisory: mod_http2 security update
The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-49975) involves a memory allocation with an excessive size value in the Apache HTTP Server's mod_http2 module, which can be exploited by sending specially crafted HTTP/2 requests. The flaw leads to denial of service by causing the server to allocate excessive memory, resulting in service disruption. The affected versions are Apache HTTP Server from 2.4.17 through 2.4.67. Red Hat's advisory for JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 includes a fix for this issue, along with other related vulnerabilities. The patch addresses the excessive memory allocation and prevents the denial of service condition. No known exploits in the wild have been reported at this time.
Potential Impact
Successful exploitation of this vulnerability results in denial of service (DoS) by causing the Apache HTTP Server to allocate excessive memory, which can disrupt availability of the web service. There is no impact on confidentiality or integrity reported. The CVSS v3.1 base score is 7.5 (high), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.
Mitigation Recommendations
A security update addressing CVE-2026-49975 is available from Red Hat as part of the JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 release. Applying this official patch will remediate the vulnerability. Users should ensure all relevant errata are applied before updating. No additional mitigations are stated in the vendor advisory. Patch status is confirmed by the Red Hat advisory; therefore, applying the update is the recommended remediation.
Red Hat Security Advisory: mod_http2 security update
Description
The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-49975) involves a memory allocation with an excessive size value in the Apache HTTP Server's mod_http2 module, which can be exploited by sending specially crafted HTTP/2 requests. The flaw leads to denial of service by causing the server to allocate excessive memory, resulting in service disruption. The affected versions are Apache HTTP Server from 2.4.17 through 2.4.67. Red Hat's advisory for JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 includes a fix for this issue, along with other related vulnerabilities. The patch addresses the excessive memory allocation and prevents the denial of service condition. No known exploits in the wild have been reported at this time.
Potential Impact
Successful exploitation of this vulnerability results in denial of service (DoS) by causing the Apache HTTP Server to allocate excessive memory, which can disrupt availability of the web service. There is no impact on confidentiality or integrity reported. The CVSS v3.1 base score is 7.5 (high), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.
Mitigation Recommendations
A security update addressing CVE-2026-49975 is available from Red Hat as part of the JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 release. Applying this official patch will remediate the vulnerability. Users should ensure all relevant errata are applied before updating. No additional mitigations are stated in the vendor advisory. Patch status is confirmed by the Red Hat advisory; therefore, applying the update is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:25090
- Cve Count
- 1
- State
- PUBLISHED
Threat ID: 6a2f1a511cccde5f2636eff6
Added to database: 06/14/2026, 21:17:05 UTC
Last enriched: 07/15/2026, 15:36:12 UTC
Last updated: 09/14/2026, 04:41:23 UTC
Views: 290
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.