HTTP/2 Bomb CVE-2026-49975
Fortinet advisory details CVE-2026-49975, an Apache HTTP Server HTTP/2 flaw enabling denial of service, affecting versions 2.4.17 through 2.4.67.
Fortinet PSIRT advisory FG-IR-26-163, revised 2026-08-19, covers CVE-2026-49975, a memory allocation with excessive size value flaw (HTTP/2 bomb) in Apache HTTP Server's mod_http2, scored CVSSv3 5.8. Malicious HTTP requests can cause a denial of service, and affected versions span Apache HTTP Server 2.4.17 through 2.4.67. The advisory text does not state which Fortinet product bundles the affected Apache component or whether exploitation has been observed.
- Excessive memory allocation in Apache mod_http2 enables denial of service
- Affects Apache HTTP Server versions 2.4.17 through 2.4.67
- CVSSv3 score 5.8; tracked as CVE-2026-49975
- CVEs
- CVE-2026-49975
- Products
- Apache HTTP Server
- Organizations
- Fortinet PSIRTApache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-49975 | Unauthenticated DoS via excessive memory allocation in Apache HTTP Server (HTTP/2 'bomb') | 7.5 | 33% | PoC ×2 |
From the original article
CVSSv3 Score: 5. 8 CVE-2026-49975Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.