CVE-2026-49975

Name
CVE-2026-49975
Description
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security@apache.org https://httpd.apache.org/security/vulnerabilities_24.html
af854a3a-2127-422b-91ae-364da2661108 http://www.openwall.com/lists/oss-security/2026/06/03/3
af854a3a-2127-422b-91ae-364da2661108 https://lists.debian.org/debian-lts-announce/2026/06/msg00009.html
af854a3a-2127-422b-91ae-364da2661108 http://www.openwall.com/lists/oss-security/2026/06/08/16
134c704f-9b21-4f2e-91b3-4a467353bcc0 https://github.com/EQSTLab/CVE-2026-49975
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:25042
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:25057
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:25090
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:25225
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:27114
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:27200
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:27201
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/security/cve/CVE-2026-49975
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://bugzilla.redhat.com/show_bug.cgi?id=2485371
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49975.json
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:36373
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:36831
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://access.redhat.com/errata/RHSA-2026:36846

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* apache-http_server >= 2.4.17 < 2.4.68
cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:* nginx >= None < 1.29.8
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* debian_linux == None == 11.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
nginx edge-main 1.30.1-r0 Jakub Jirutka <jakub@jirutka.cz> fixed
nginx edge-main 1.28.3-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.28.2-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.28.2-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.28.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.28.0-r9 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.28.0-r8 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.28.0-r7 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.28.0-r6 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.28.0-r5 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.28.0-r4 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.28.0-r3 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.28.0-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.28.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.26.3-r4 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.26.3-r3 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.26.3-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.26.3-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.26.2-r4 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.26.2-r3 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.26.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.24.0-r12 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.22.1-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.22.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.20.2-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.20.2-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.20.1-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.20.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.16.1-r6 None possibly vulnerable
nginx edge-main 1.16.1-r0 None possibly vulnerable
nginx edge-main 1.14.1-r0 None possibly vulnerable
nginx edge-main 1.12.1-r0 None possibly vulnerable
nginx 3.23-main 1.28.3-r4 Jakub Jirutka <jakub@jirutka.cz> fixed
nginx 3.23-main 1.28.3-r3 Jakub Jirutka <jakub@jirutka.cz> fixed
nginx 3.23-main 1.28.3-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.23-main 1.28.3-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.23-main 1.28.3-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.23-main 1.28.2-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.23-main 1.28.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.23-main 1.28.0-r8 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.22-main 1.28.3-r4 Jakub Jirutka <jakub@jirutka.cz> fixed
nginx 3.22-main 1.28.3-r3 Jakub Jirutka <jakub@jirutka.cz> fixed
nginx 3.22-main 1.28.3-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.22-main 1.28.3-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.22-main 1.28.3-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.22-main 1.28.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.22-main 1.28.0-r3 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.22-main 1.26.3-r0 None possibly vulnerable
nginx 3.22-main 1.26.2-r0 None possibly vulnerable
nginx 3.22-main 1.24.0-r12 None possibly vulnerable
nginx 3.22-main 1.22.1-r0 None possibly vulnerable
nginx 3.22-main 1.20.2-r2 None possibly vulnerable
nginx 3.22-main 1.20.1-r1 None possibly vulnerable
nginx 3.22-main 1.20.1-r0 None possibly vulnerable
nginx 3.22-main 1.16.1-r6 None possibly vulnerable
nginx 3.22-main 1.16.1-r0 None possibly vulnerable
nginx 3.22-main 1.14.1-r0 None possibly vulnerable
nginx 3.22-main 1.12.1-r0 None possibly vulnerable
nginx 3.21-main 1.26.3-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.21-main 1.26.2-r4 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.21-main 1.26.2-r3 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.21-main 1.26.2-r0 None possibly vulnerable
nginx 3.21-main 1.24.0-r12 None possibly vulnerable
nginx 3.21-main 1.22.1-r0 None possibly vulnerable
nginx 3.21-main 1.20.2-r2 None possibly vulnerable
nginx 3.21-main 1.20.1-r1 None possibly vulnerable
nginx 3.21-main 1.20.1-r0 None possibly vulnerable
nginx 3.21-main 1.16.1-r6 None possibly vulnerable
nginx 3.21-main 1.16.1-r0 None possibly vulnerable
nginx 3.21-main 1.14.1-r0 None possibly vulnerable
nginx 3.21-main 1.12.1-r0 None possibly vulnerable
nginx 3.20-main 1.26.3-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.20-main 1.26.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.20-main 1.24.0-r12 None possibly vulnerable
nginx 3.20-main 1.22.1-r0 None possibly vulnerable
nginx 3.20-main 1.20.2-r2 None possibly vulnerable
nginx 3.20-main 1.20.1-r1 None possibly vulnerable
nginx 3.20-main 1.20.1-r0 None possibly vulnerable
nginx 3.20-main 1.16.1-r6 None possibly vulnerable
nginx 3.20-main 1.16.1-r0 None possibly vulnerable
nginx 3.20-main 1.14.1-r0 None possibly vulnerable
nginx 3.20-main 1.12.1-r0 None possibly vulnerable
nginx 3.19-main 1.24.0-r16 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.19-main 1.24.0-r12 None possibly vulnerable
nginx 3.19-main 1.22.1-r0 None possibly vulnerable
nginx 3.19-main 1.20.2-r2 None possibly vulnerable
nginx 3.19-main 1.20.1-r1 None possibly vulnerable
nginx 3.19-main 1.20.1-r0 None possibly vulnerable
nginx 3.19-main 1.16.1-r6 None possibly vulnerable
nginx 3.19-main 1.16.1-r0 None possibly vulnerable
nginx 3.19-main 1.14.1-r0 None possibly vulnerable
nginx 3.19-main 1.12.1-r0 None possibly vulnerable
apache2 edge-main 2.4.68-r0 Kaarle Ritvanen <kunkku@alpinelinux.org> fixed
apache2 3.24-main 2.4.68-r0 Kaarle Ritvanen <kunkku@alpinelinux.org> fixed
apache2 3.23-main 2.4.68-r0 Kaarle Ritvanen <kunkku@alpinelinux.org> fixed
apache2 3.22-main 2.4.68-r0 Kaarle Ritvanen <kunkku@alpinelinux.org> fixed
apache2 3.21-main 2.4.68-r0 Kaarle Ritvanen <kunkku@alpinelinux.org> fixed