CVE-2026-49975
Apache HTTP Server: mod_http2 denial of service
- Published
- Jun 8, 2026
- Updated
- Aug 19, 2026
- Assigning CNA
- apache
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HLow · next 30 days
- Percentile
- 90.8%
- Model date
- Oct 15, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
Sources
HTTP2-Bomb
Proof-of-concept exploit for CVE-2026-49975 (HTTP/2 Bomb), a remote denial-of-service vulnerability affecting major web servers via HPACK bomb and Slowloris-style memory exhaustion.
CVE-2026-49975
HTTP/2 Bomb PoC — CVE-2026-49975 (HPACK indexed reference bomb + flow-control stall)
Security research PoC for CVE-2026-49975: HTTP/2 HPACK compression bomb + flow-control hold DoS in Apache mod_http2
PoC exploit for CVE-2026-49975 HTTP/2 Bomb DoS vulnerability. Demonstrates HPACK indexed reference bomb combined with flow-control window stall to exhaust server memory via single connection.
- CVE-2026-49975Exploit
CVE-2026-49975漏洞复现
Proof-of-concept HTTP/2 Bomb exploit for CVE-2026-49975, a cookie-header memory exhaustion DoS in Apache HTTP Server 2.4.17-2.4.67, with Docker lab and PoC script.
HTTP/2 Bomb
- http2-bombPoC
Proof of Concept (PoC) for CVE-2026-49975 – HTTP/2 server memory exhaustion attack leveraging HPACK amplification and connection retention (HTTP/2 Slowloris).
- http2-bomb-analysis-paperResearch
HTTP/2 Bomb: HPACK indexed-reference amplification + flow-control stall. A high school student's full protocol analysis (LaTeX). CVE-2026-49975, CVE-2026-47774.
- http2-bombPoC
CVE-2026-49975 HTTP/2 Stream Amplification — Docker PoC with Web Console
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.