CVE-2026-49975CWE-409CWE-789
CVE-2026-49975
High · published June 8, 2026
What it is
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.
This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
The record
Technical detail
- CVSS v3.1
- 7.5 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.04169 · 90.9th percentile
- Weaknesses
- CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification); CWE-789 · Memory Allocation with Excessive Size Value
- Published
- 2026-06-08T20:16Z
Affected products (2)
| Product | Versions | Fixed in |
|---|
| apache/http_server | ≥ 2.4.17, < 2.4.68 | 2.4.68 |
| debian/debian_linux | all versions | — |
References (22)
EPSS history
Timeline