HTTP/2 Bomb CVE-2026-49975

CVE-2026-49975 is a memory-allocation flaw (CWE-789, 'Memory Allocation with Excessive Size Value', with related data-amplification handling per CWE-409) in Apache HTTP Server's mod_http module; related press coverage characterizes it as an HTTP/2 'bomb'. An unauthenticated remote attacker triggers it by sending malicious HTTP requests that cause the server to allocate memory with an excessively large size, and the practical impact is denial of service — availability loss with no direct confidentiality or integrity impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability impact high). It affects Apache HTTP Server 2.4.17 through 2.4.67, and the advisory data also lists Debian Linux as affected through its shipped Apache packages (specific Debian releases are not specified). Exploitation has not been confirmed in the wild and the flaw is not in CISA's KEV catalog, but a public proof-of-concept exists (github.com/EQSTLab/CVE-2026-49975) and EPSS assigns a 31% probability of exploitation within 30 days (98th percentile), so near-term exploitation is plausible.

Do: Upgrade Apache HTTP Server to the first fixed release issued after 2.4.67 (the advisory marks everything from 2.4.17 through 2.4.67 as affected), and on Debian apply the patched apache2 package via security updates. In the interim, check whether HTTP/2 handling is enabled and consider disabling it or rate-limiting connections from untrusted sources to blunt memory-exhaustion attacks. Review the public EQSTLab PoC to validate exposure, and watch memory usage for spikes as an indicator of exploitation attempts.