Apache HTTP Server: mod_http2 denial of service (CVE-2026-49975)
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
AI Analysis
Technical Summary
CVE-2026-49975 is a memory allocation vulnerability in Apache HTTP Server's mod_http module related to the handling of certain cookie headers in the HTTP/2 implementation. When processing maliciously crafted HTTP requests, the server may allocate excessive memory, leading to resource exhaustion and denial of service. The vulnerability affects Apache HTTP Server versions from 2.4.17 through 2.4.67. Ubuntu security advisories (USN-8384-1) confirm the issue and provide fixed package versions for multiple Ubuntu releases. The vulnerability does not impact confidentiality or integrity but can disrupt service availability.
Potential Impact
A remote attacker can cause Apache HTTP Server to consume excessive resources by sending specially crafted HTTP/2 requests with certain cookie headers. This results in a denial of service condition, impacting server availability. There is no indication of confidentiality or integrity compromise. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Ubuntu has released fixed package versions for affected releases, including 26.04 LTS, 25.10, 24.04 LTS, and 22.04 LTS. Users should apply standard system updates to upgrade Apache HTTP Server to the patched versions (e.g., 2.4.66-2ubuntu2.2 for 26.04 LTS). Applying these updates will remediate the vulnerability. No additional mitigation steps are required beyond updating to the fixed packages.
Apache HTTP Server: mod_http2 denial of service (CVE-2026-49975)
Description
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
Affected software
pkg:deb/ubuntu/[email protected]+esm18?arch=source&distro=esm-infra-legacy/xenialpkg:deb/ubuntu/[email protected]+esm9?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/[email protected]+esm4?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/[email protected]+esm4?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/[email protected]+esm3?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/[email protected]?arch=source&distro=jammypkg:deb/ubuntu/[email protected]?arch=source&distro=jammypkg:deb/ubuntu/[email protected]?arch=source&distro=noblepkg:deb/ubuntu/[email protected]?arch=source&distro=noblepkg:deb/ubuntu/[email protected]?arch=source&distro=questingpkg:deb/ubuntu/[email protected]?arch=source&distro=questingpkg:deb/ubuntu/[email protected]?arch=source&distro=resolutepkg:deb/ubuntu/[email protected]?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-49975 is a memory allocation vulnerability in Apache HTTP Server's mod_http module related to the handling of certain cookie headers in the HTTP/2 implementation. When processing maliciously crafted HTTP requests, the server may allocate excessive memory, leading to resource exhaustion and denial of service. The vulnerability affects Apache HTTP Server versions from 2.4.17 through 2.4.67. Ubuntu security advisories (USN-8384-1) confirm the issue and provide fixed package versions for multiple Ubuntu releases. The vulnerability does not impact confidentiality or integrity but can disrupt service availability.
Potential Impact
A remote attacker can cause Apache HTTP Server to consume excessive resources by sending specially crafted HTTP/2 requests with certain cookie headers. This results in a denial of service condition, impacting server availability. There is no indication of confidentiality or integrity compromise. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Ubuntu has released fixed package versions for affected releases, including 26.04 LTS, 25.10, 24.04 LTS, and 22.04 LTS. Users should apply standard system updates to upgrade Apache HTTP Server to the patched versions (e.g., 2.4.66-2ubuntu2.2 for 26.04 LTS). Applying these updates will remediate the vulnerability. No additional mitigation steps are required beyond updating to the fixed packages.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-49975
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:25.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a58b3ff68715ace43d66ccb
Added to database: 07/16/2026, 10:35:43 UTC
Last enriched: 08/18/2026, 13:51:53 UTC
Last updated: 09/12/2026, 22:01:34 UTC
Views: 46
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.