CVE-2026-49975: apache software foundation apache http server
CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2026-49975RHSA-2026:25057RHSA-2026:25090RHSA-2026:25225UBUNTU-CVE-2026-49975DEBIAN-CVE-2026-49975
Published 08-06-2026Last modified 19-08-2026
Vulnerability summary
CVE-2026-49975 is a high (CVSS 7.5) vulnerability in apache software foundation apache http server. EPSS estimates a 4.17% chance of exploitation in the next 30 days, higher than 90.7% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
4.17%
0%100%
Low · -30.13 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 17 · Related 12MGASA-2026-0289OPENSUSE-SU-2026:21235-1RHSA-2026:25042RHSA-2026:27200RHSA-2026:36373RHSA-2026:36831RHSA-2026:36846RHSA-2026:50538RHSA-2026:50572RHSA-2026:55930RHSA-2026:55992SUSE-SU-2026:22564-1SUSE-SU-2026:2686-1SUSE-SU-2026:2717-1SUSE-SU-2026:2735-1SUSE-SU-2026:2759-1USN-8571-1USN-8384-1USN-8398-1USN-8398-2USN-8398-3USN-8398-4
Timeline
- 08-06-2026PublishedVulnerability first disclosed.
- 19-08-2026Last modifiedVulnerability information updated.
Description
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
CVSS metrics
6 scores · 6 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 6 agree
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
4.17%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
-30.13 pp
From 34.30% on 18-09-2026
18-09-202618-10-2026
EPSS score4.17%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCve 2026 49975
Maturity: poc
Weaknesses
CWE · root cause- CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
- CWE-409Improper Handling of Highly Compressed Data (Data Amplification)The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
Affected systems
Redhat22 products
- httpd< 0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
- httpd-debuginfo< 0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
- httpd-debugsource< 0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
- httpd-devel< 0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
- httpd-filesystem< 0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
Alpine2 products
- apache2< 2.4.68-r0
- nginx< 1.26.3-r1 | < 1.28.3-r3 | < 1.30.1-r0
Debian2 products
- apache2< 2.4.67-1~deb12u3 | < 2.4.67-1~deb13u3 | < 2.4.67-2
- debian_linuxEOL11.0
Ubuntu2 products
- apache2< 2.4.18-2ubuntu3.17+esm19 | < 2.4.29-1ubuntu4.27+esm10 | < 2.4.41-4ubuntu3.23+esm5 | < 2.4.52-1ubuntu4.21 | < 2.4.58-1ubuntu8.13 | < 2.4.64-1ubuntu3.5 | < 2.4.66-2ubuntu2.2
- nginx< 1.4.6-1ubuntu3.9+esm8 | < 1.10.3-0ubuntu0.16.04.5+esm9 | < 1.14.0-0ubuntu1.11+esm4 | < 1.18.0-0ubuntu1.7+esm3 | < 1.18.0-6ubuntu14.15 | < 1.24.0-2ubuntu7.12 | < 1.28.0-6ubuntu1.7 | < 1.28.3-2ubuntu1.5
Apache1 product
- http_server≥ 2.4.17, < 2.4.68
Apache software foundation1 product
- apache http server≥ 2.4.17, ≤ 2.4.67
6 vendors · 30 products
References
40 links- httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
