The vulnerability identified as UBUNTU-CVE-2026-49975 involves the Apache HTTP Server's mod_http module improperly handling memory allocation requests with excessively large size values. This flaw can be triggered by specially crafted HTTP requests, resulting in a denial of service condition. The affected Apache HTTP Server versions range from 2.4.17 through 2.4.67. The vulnerability is characterized by a CVSS 3.1 vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high impact on availability. No vendor advisory or patch information is provided in the input data, and no exploits are known in the wild.

Successful exploitation leads to denial of service by exhausting memory resources through excessive allocation requests in the mod_http module. This disrupts availability of the Apache HTTP Server but does not affect confidentiality or integrity of data. The impact is limited to service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from Apache and Ubuntu security advisories. Until a fix is available, consider applying temporary mitigations such as limiting request sizes or using web application firewalls to detect and block suspicious requests targeting mod_http memory allocation.