CVE-2026-49975

HIGH 7.5 PoC AVAILABLE

Published 2026-06-08 · Last modified 2026-07-15

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

LIKELY TARGET

11.5% modeled chance of exploitation in the next 30 days (96th percentile) · public exploit code available. Prioritize remediation.

Exploitation likelihood

11.5%chance of exploitation in 30 days · 96th percentile

○ In CISA KEV ● Public exploit / PoC

Impact if exploited

7.5CVSS 3.1 · HIGH

ConfidentialityNone
IntegrityNone
AvailabilityHigh

What an attacker needs

✓Access: Reachable over the network — no local access needed
✓Privileges: No account or privileges required
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

reference https://github.com/EQSTLab/CVE-2026-49975
github-search Search GitHub for public PoC repos

Test against your own equipment

curl -s https://vulnpedia.com/cve/CVE-2026-49975/poc.jsonMachine-readable PoC index for this CVE (for automation).

Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-49975/poc.json

Affected

Vendors Apache Software Foundation Red Hat Apache Debian

Products Apache Http Server Jboss Core Services For Rhel 8 Jboss Core Services On Rhel 7 Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long Life Add On Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long Life Add On Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat Enterprise Linux 8.8 Update Services For Sap Solutions Red Hat Enterprise Linux 9

Weakness (CWE)

CWE-789: Memory Allocation with Excessive Size Value
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Known Affected Software Configurations

Vendor	Product	Version range
Apache	Http Server	≥ 2.4.17 and < 2.4.68
Debian	Debian Linux	11.0

All CVSS metrics

HIGH 7.5 v3.1 · ADP Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
HIGH 7.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Sources: NVD · CVE.org · EPSS