CVE-2026-49975
7.5 HIGHMemory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP ...
Published: 2026-06-08 · Last updated: 2026-06-10
Severity and scoring
- CVSS
- 7.5 HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CWE
- CWE-789
Affected products
| Vendor | Product |
|---|---|
| apache | debian_linux, http_server, nginx |
| debian | debian_linux, http_server, nginx |
| f5 | debian_linux, http_server, nginx |
Description
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-49975
- [Vendor advisory]https://httpd.apache.org/security/vulnerabilities_24.html
- [Other]http://www.openwall.com/lists/oss-security/2026/06/03/3
- [Other]http://www.openwall.com/lists/oss-security/2026/06/08/16
- [Other]https://lists.debian.org/debian-lts-announce/2026/06/msg00009.html
Related CVEs
Same vendor
- CVE-2026-34905 — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer (6.5 MEDIUM)
- CVE-2026-34031 — Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer (6.5 MEDIUM)
- CVE-2026-33582 — Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer (6.5 MEDIUM)
- CVE-2026-25699 — Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer (6.1 MEDIUM)
- CVE-2026-25688 — Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer (6.1 MEDIUM)
Same CWE
- CVE-2026-47734 — Dulwich is a pure-Python implementation of the Git file formats and protocols (5.7 MEDIUM)
- CVE-2026-10142 — kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-i... (7.5 HIGH)
- CVE-2026-52759 — Ghidra before 12.1.1 contains an uncontrolled memory allocation vulnerability in the Mach-O binary parser that allows attackers to cause ... (5.5 MEDIUM)
- CVE-2026-52753 — Ghidra before 12.0.3 contains an out-of-memory vulnerability in the rust_demangle function that allocates unbounded output buffers withou... (5.5 MEDIUM)
- CVE-2026-41178 — OpenTelemetry-Go is the Go implementation of OpenTelemetry (5.3 MEDIUM)