# CVE-2026-49975

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

- Page: https://www.vulneraibility.com/cve/CVE-2026-49975
- CVSS: 7.5
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 32.95% (percentile 98.4)
- Unvetted proof-of-concept code on GitHub: 13 GitHub proofs of concept (first 2026-06-03)
- CISA SSVC: exploitation poc, automatable yes, technical impact partial (assessed 2026-06-18)
- Weakness: CWE-789, CWE-409
- Published: 2026-06-08

## Affected versions

- Apache Software Foundation Apache HTTP Server: affected >= 2.4.17 and <= 2.4.67

A version outside these ranges is not a statement that it is unaffected.

## References

- [advisory] https://httpd.apache.org/security/vulnerabilities_24.html
- [other] http://www.openwall.com/lists/oss-security/2026/06/03/3
- [other] https://lists.debian.org/debian-lts-announce/2026/06/msg00009.html
- [other] http://www.openwall.com/lists/oss-security/2026/06/08/16
- [exploit] https://github.com/EQSTLab/CVE-2026-49975
- [other] https://access.redhat.com/security/cve/CVE-2026-49975
- [other] https://bugzilla.redhat.com/show_bug.cgi?id=2485371
- [other] https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49975.json
- [advisory] https://access.redhat.com/errata/RHSA-2026:27200
- [advisory] https://access.redhat.com/errata/RHSA-2026:50538
- [advisory] https://access.redhat.com/errata/RHSA-2026:25225
- [advisory] https://access.redhat.com/errata/RHSA-2026:25090
- [advisory] https://access.redhat.com/errata/RHSA-2026:36846
- [advisory] https://access.redhat.com/errata/RHSA-2026:36831
- [advisory] https://access.redhat.com/errata/RHSA-2026:36373
- [advisory] https://access.redhat.com/errata/RHSA-2026:55930
- [advisory] https://access.redhat.com/errata/RHSA-2026:55992
- [advisory] https://access.redhat.com/errata/RHSA-2026:50572
- [advisory] https://access.redhat.com/errata/RHSA-2026:25057
- [advisory] https://access.redhat.com/errata/RHSA-2026:25042
- [advisory] https://access.redhat.com/errata/RHSA-2026:27201
- [advisory] https://access.redhat.com/errata/RHSA-2026:27114

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.