CVE-2026-49975

⚠️ high

Summary

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

CVSS Score

7.5

High

EPSS Score

31.0

Exploit Probability

Published Date

2026-06-08

First Seen: 2026-06-09

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 68.0% of all 349,016 vulnerabilities in our database.

#111,749

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Jun 18, 2026

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Quang Luong of Calif.IO in collaboration with OpenAI Codex

SSVC data provided by CISA

Last Modified 2026-08-19

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE IDs (Weakness Types)

CWE-789 CWE-409

📦 Affected Products 3

Vendor	Product	Status	Affected Versions
debian	debian_linux	Affected	v11.0
apache	http_server	Affected	> 2.4.17 < 2.4.68
f5	nginx	Affected	< 1.29.8

🔗 References 22

https://httpd.apache.org/security/vulnerabilities_24...

Vendor Advisory

http://www.openwall.com/lists/oss-security/2026/06/03/3

Mailing List Third Party Advisory

http://www.openwall.com/lists/oss-security/2026/06/0...

Mailing List Third Party Advisory

https://lists.debian.org/debian-lts-announce/2026/06...

Mailing List Third Party Advisory

https://access.redhat.com/errata/RHSA-2026:25042

https://access.redhat.com/errata/RHSA-2026:25057

https://access.redhat.com/errata/RHSA-2026:25090

https://access.redhat.com/errata/RHSA-2026:25225

https://access.redhat.com/errata/RHSA-2026:27114

https://access.redhat.com/errata/RHSA-2026:27200

https://access.redhat.com/errata/RHSA-2026:27201

https://access.redhat.com/errata/RHSA-2026:36373

https://access.redhat.com/errata/RHSA-2026:36831

https://access.redhat.com/errata/RHSA-2026:36846

https://access.redhat.com/errata/RHSA-2026:50538

https://access.redhat.com/errata/RHSA-2026:50572

https://access.redhat.com/errata/RHSA-2026:55930

https://access.redhat.com/errata/RHSA-2026:55992

https://access.redhat.com/security/cve/CVE-2026-49975

https://bugzilla.redhat.com/show_bug.cgi?id=2485371

https://github.com/EQSTLab/CVE-2026-49975

Exploit Third Party Advisory

https://security.access.redhat.com/data/csaf/v2/vex/...

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-12996	⚠️ high	8.1	0.5	A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to poten...	2026-07-30
CVE-2026-14355	🔶 medium	5.6	0.3	In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algo...	2026-07-03
CVE-2026-56968	ℹ️ low	3.7	0.3	GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could...	2026-06-23
CVE-2026-29167	⛔ critical	9.8	0.7	Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apac...	2026-06-08
CVE-2026-29170	🔶 medium	6.1	0.5	A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4....	2026-06-08
CVE-2026-34355	⚠️ high	7.5	1.1	A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. U...	2026-06-08

These CVEs affect the same products