CVEFinder.io

CVE-2026-49975

⚠ī¸ high
🔍 Scan for this CVE
Summary

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

CVSS Score
7.5
High
EPSS Score
31.0
Exploit Probability
Published Date
2026-06-08
First Seen: 2026-06-09
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 67.8% of all 365,863 vulnerabilities in our database.

#117,960
Above average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Jun 18, 2026
🔍 Exploitation Status
Poc
Proof-of-concept available
⚙ī¸ Automatable
YES
Can be exploited automatically
đŸ’Ĩ Technical Impact
Partial
Limited system impact
🏆 Discovered By
Quang Luong of Calif.IO in collaboration with OpenAI Codex
SSVC data provided by CISA
Last Modified 2026-08-19
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE IDs (Weakness Types)
CWE-789 CWE-409

đŸ“Ļ Affected Products 3

Vendor Product Status Affected Versions
debian debian_linux Affected
v11.0
apache http_server Affected
> 2.4.17 < 2.4.68
f5 nginx Affected
< 1.29.8

🔗 References 22

https://httpd.apache.org/security/vulnerabilities_24...
Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/03/3
Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/06/0...
Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2026/06...
Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:25042
https://access.redhat.com/errata/RHSA-2026:25057
https://access.redhat.com/errata/RHSA-2026:25090
https://access.redhat.com/errata/RHSA-2026:25225
https://access.redhat.com/errata/RHSA-2026:27114
https://access.redhat.com/errata/RHSA-2026:27200
https://access.redhat.com/errata/RHSA-2026:27201
https://access.redhat.com/errata/RHSA-2026:36373
https://access.redhat.com/errata/RHSA-2026:36831
https://access.redhat.com/errata/RHSA-2026:36846
https://access.redhat.com/errata/RHSA-2026:50538
https://access.redhat.com/errata/RHSA-2026:50572
https://access.redhat.com/errata/RHSA-2026:55930
https://access.redhat.com/errata/RHSA-2026:55992
https://access.redhat.com/security/cve/CVE-2026-49975
https://bugzilla.redhat.com/show_bug.cgi?id=2485371
https://github.com/EQSTLab/CVE-2026-49975
Exploit Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/...

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-42356 ℹī¸ low 3.7 0.5 Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI pr... 2026-10-01
CVE-2026-42528 đŸ”ļ medium 4.3 0.4 A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebD... 2026-10-01
CVE-2026-46729 ⚠ī¸ high 7.5 0.5 NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affe... 2026-10-01
CVE-2026-47360 ⚠ī¸ high 7.5 0.4 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie modu... 2026-10-01
CVE-2026-48005 ⚠ī¸ high 7.5 0.6 Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all p... 2026-10-01
CVE-2026-56153 ⚠ī¸ high 7.5 0.5 Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: fr... 2026-10-01
These CVEs affect the same products