HTTP/2 Bomb CVE-2026-49975

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Aug 12, 2026 · Fortinet PSIRT

   Detected

   CVSSv3 Score: 5.8 CVE-2026-49975Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67. Revised on 2026-08-19 00:00:00

Sources

• Apache Software FoundationVendor advisoryCVE-2026-49975

  Named on the public Apache Software Foundation page.

  httpd.apache.org
• CVE.orgVulnerability recordCVE-2026-49975

  Official CVE identifier

  cve.org
• Fortinet PSIRTVendor advisoryCVE-2026-49975

  CVSSv3 Score: 5.8 CVE-2026-49975Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67. Revised on 2026-08-19 00:00:00

  fortiguard.fortinet.com