Most recent entries from all

ALSA-2026:25057 — Important: mod_http2 security update

Affected: AlmaLinux:9: mod_http2

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

* httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-07789

BELL-CVE-2026-49975

Affected: Alpaquita:23: apache2, Alpaquita:23: nginx, Alpaquita:25: apache2, Alpaquita:25: nginx, Alpaquita:stream: apache2, Alpaquita:stream: nginx

BIT-apache-2026-49975 — Apache HTTP Server: mod_http2 denial of service

Affected: Bitnami: apache

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.

This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

certfr-2026-avi-0710 — De multiples vulnérabilités ont été découvertes dans Apache HTTP Server. Certaines d'entre elles permettent à un attaqu…

certfr-2026-avi-0710

cnvd-2026-23633

EUVD-2026-355323

fkie_cve-2026-49975

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.

This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

GHSA-262v-g5h9-6mc6

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.

This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

jvndb-2026-026849

Vulnerability(CVE-2026-49975) has been found in Cosminexus HTTP Server. This vulnerability does not apply if HTTP/2 protocol is disabled.

msrc_CVE-2026-49975 — Apache HTTP Server: mod_http2 denial of service

msrc_CVE-2026-49975

OESA-2026-2611 — mod_http2 security update

Affected: openEuler:24.03-LTS-SP1: mod_http2, openEuler:24.03-LTS-SP3: mod_http2, openEuler:20.03-LTS-SP4: mod_http2, openEuler:22.03-LTS-SP4: mod_http2

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es):

A vulnerability was found in Apache HTTP Server (Web Server) (affected version not known). It has been rated as critical.Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use.Impacted is availability.The exploit is available at blog.calif.io. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $5k-$25k.Applying a patch is able to eliminate this problem.(CVE-2026-49975)

openSUSE-SU-2026:21235-1 — Security update for apache2

Security update for apache2

RHSA-2026:25042 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration httpd: Apache HTTP Server: Cross-site scripting in mod_proxy_ftp via HTML directory list generation httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime httpd: Apache HTTP Server: Local .htaccess authors can read files with httpd user privileges httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server httpd: Apache HTTP Server: Denial of Service via crafted regular expressions httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack

RLSA-2026:25057 — Important: mod_http2 security update

Affected: Rocky Linux:9: mod_http2

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

* httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:22564-1 — Security update for apache2

Security update for apache2

UBUNTU-CVE-2026-49975

Affected: Ubuntu:Pro:14.04:LTS: nginx, Ubuntu:Pro:16.04:LTS: apache2, Ubuntu:Pro:16.04:LTS: nginx, Ubuntu:Pro:18.04:LTS: apache2, Ubuntu:Pro:18.04:LTS: nginx, Ubuntu:Pro:20.04:LTS: apache2, Ubuntu:Pro:20.04:LTS: nginx, Ubuntu:22.04:LTS: apache2, Ubuntu:22.04:LTS: nginx, Ubuntu:24.04:LTS: apache2 and 5 more

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

WID-SEC-W-2026-1791 — HTTP/2-Implementierungen: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiedenen HTTP/2-Implementierungen ausnutzen, um einen Denial of Service Angriff durchzuführen.