CVE-2026-49975

High · CVSS 7.5

Apache HTTP Server (mod_http) — Memory Allocation with Excessive Size Value leading to Denial of Service (CWE-789, CWE-409)

CVSS: 7.5; nvd
EPSS: 28.0%; 98th pct
KEV: No
Class: kernel local; CWE-789, CWE-409

Description

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

Search profile — drives PoC discovery

Symbols mod_httpap_mallocapr_pallocap_rwritecontent-lengthexcessive allocationdeflatemod_deflater->remainingap_get_brigade

Keywords CVE-2026-49975Apache HTTP Servermod_httpdenial of servicememory allocationexcessive sizeCWE-789CWE-409httpd 2.4malicious HTTP requestoss-securityRHSA-2026:25042

Versions: 2.4.17 through 2.4.67

Ranked PoCs (12) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

EQSTLab/CVE-2026-49975 candidate

containerized · cited in references · recent activity

gh_search · Python

★ 13
0xc03307b/CVE-2026-49975 candidate

containerized · recent activity

gh_search

★ 0
Manisso/http2-bomb candidate

known researcher · recent activity

gh_search · Python

★ 0
obrige/http2-bomb candidate

containerized

gh_search · HTML

★ 4
adminlove520/http2-bomb-detector needs review

recent activity

gh_search · Python

★ 2
LSG-PolarBear/CVE-2026-49975 needs review

recent activity

gh_search

★ 4
LiaoZiqi-GZFLS/CVE-2026-49975 needs review

recent activity

gh_search · Python

★ 2
minc-nice-100/http2-bomb-analysis-paper needs review

recent activity

gh_search · TeX

★ 1
razureink/cve-2026-49975-http2bomb_reproduction needs review

recent activity

gh_search · Python

★ 1
mrx-arafat/CVE-2026-49975-POC needs review

gh_search · Python

★ 28
fevar54/Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb- needs review

gh_search · Python

★ 6
renzi25031469/CVE-2026-49975-HTTP-2-Bomb needs review

gh_search · Shell

★ 2

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-06-25T18:00:38.000Z · profiled 2026-07-01T18:30:14.000Z