Unauthenticated DoS via excessive memory allocation in Apache HTTP Server (HTTP/2 'bomb')
CVSS 3.1
7.5high
EPSS
34%p98
Published
()
Modified
AI analysis
CVE-2026-49975 is a memory-allocation flaw (CWE-789, 'Memory Allocation with Excessive Size Value', with related data-amplification handling per CWE-409) in Apache HTTP Server's mod_http module; related press coverage characterizes it as an HTTP/2 'bomb'. An unauthenticated remote attacker triggers it by sending malicious HTTP requests that cause the server to allocate memory with an excessively large size, and the practical impact is denial of service — availability loss with no direct confidentiality or integrity impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability impact high). It affects Apache HTTP Server 2.4.17 through 2.4.67, and the advisory data also lists Debian Linux as affected through its shipped Apache packages (specific Debian releases are not specified). Exploitation has not been confirmed in the wild and the flaw is not in CISA's KEV catalog, but a public proof-of-concept exists (github.com/EQSTLab/CVE-2026-49975) and EPSS assigns a 31% probability of exploitation within 30 days (98th percentile), so near-term exploitation is plausible.
What to do: Upgrade Apache HTTP Server to the first fixed release issued after 2.4.67 (the advisory marks everything from 2.4.17 through 2.4.67 as affected), and on Debian apply the patched apache2 package via security updates. In the interim, check whether HTTP/2 handling is enabled and consider disabling it or rate-limiting connections from untrusted sources to blunt memory-exhaustion attacks. Review the public EQSTLab PoC to validate exposure, and watch memory usage for spikes as an indicator of exploitation attempts.
Affected
apache http server
2.4.17 through 2.4.67 (inclusive)
debian linux
—
Estimated exposure
mass≈1M+ internet-exposed Apache httpd servers (only those running 2.4.17–2.4.67 with the affected HTTP/2 module enabled) — Apache httpd powers roughly a quarter of all websites and public internet scans (Shodan/Censys) have historically indexed on the order of a million exposed Apache servers, so the vulnerable population is plausibly hundreds of thousands to…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
Fortinet advisory details CVE-2026-49975, an Apache HTTP Server HTTP/2 flaw enabling denial of service, affecting versions 2.4.17 through 2.4.67.
Fortinet PSIRT advisory FG-IR-26-163, revised 2026-08-19, covers CVE-2026-49975, a memory allocation with excessive size value flaw (HTTP/2 bomb) in Apache HTTP Server's mod_http2, scored CVSSv3 5.8. Malicious HTTP requests can cause a denial of service, and affected versions span Apache HTTP Server 2.4.17 through 2.4.67. The advisory text does not state which Fortinet product bundles the affected Apache component or whether exploitation has been observed.