7.5
HIGH
CVSS 3.1
CVE-2026-49975
Apache HTTP Server: mod_http2 denial of service
Overview
Description
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
Details
INFO
Published Date :
June 8, 2026, 4:16 p.m.
Last Modified :
July 23, 2026, 7:10 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Impact
Affected Products
The following products are affected by CVE-2026-49975
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | ||||
| CVSS 3.1 | HIGH | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c |
Solution
Update Apache HTTP Server to patch denial of service vulnerability.
- Apply the latest security patch for Apache HTTP Server.
- Upgrade to a fixed version of Apache HTTP Server.
- Review HTTP request handling for resource exhaustion.
Public PoC/Exploit Available at Github
CVE-2026-49975 has a 27 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-49975.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-49975 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-49975
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Rust Shell
Updated: 1 week, 2 days ago
0 stars
0 fork
0 watcher
Born at : July 9, 2026, 6:47 p.m.
This repo has been linked 9 different CVEs too.
Proof of Concept (PoC) for CVE-2026-49975 – HTTP/2 server memory exhaustion attack leveraging HPACK amplification and connection retention (HTTP/2 Slowloris).
Python
Updated: 2 weeks, 5 days ago
0 stars
0 fork
0 watcher
Born at : July 5, 2026, 8:50 p.m.
This repo has been linked 1 different CVEs too.
网络服务 Fuzz-SymExec 与智能体适配平台
Makefile C HTML JavaScript Python Shell Perl CMake CSS TeX
Updated: 2 weeks, 6 days ago
0 stars
0 fork
0 watcher
Born at : July 3, 2026, 9:19 a.m.
This repo has been linked 2 different CVEs too.
None
CSS Dockerfile JavaScript Python Shell HTML
Updated: 4 weeks, 1 day ago
0 stars
0 fork
0 watcher
Born at : June 23, 2026, 11:11 a.m.
This repo has been linked 1 different CVEs too.
争对2026-49975漏洞所创作的普罗米修斯附属模组，但模组本体可以独立运行。改模组底层逻辑可以视为泛洪攻击
Python Batchfile Shell JavaScript CSS HTML
Updated: 1 month ago
0 stars
0 fork
0 watcher
Born at : June 18, 2026, 1:31 p.m.
This repo has been linked 2 different CVEs too.
HTTP2-Bomb
Python Dockerfile
Updated: 1 month ago
0 stars
0 fork
0 watcher
Born at : June 18, 2026, 1:17 p.m.
This repo has been linked 1 different CVEs too.
None
Shell
Updated: 1 month ago
0 stars
0 fork
0 watcher
Born at : June 14, 2026, 12:57 p.m.
This repo has been linked 1 different CVEs too.
None
Python
Updated: 1 month, 1 week ago
0 stars
0 fork
0 watcher
Born at : June 13, 2026, 5:05 p.m.
This repo has been linked 1 different CVEs too.
HTTP/2 Bomb (CVE-2026-49975) non-destructive vulnerability detector for Nginx / Apache httpd. Zero-dependency Python.
Python
Updated: 1 month, 1 week ago
1 stars
0 fork
0 watcher
Born at : June 13, 2026, 4:05 a.m.
This repo has been linked 1 different CVEs too.
HTTP/2 Bomb: HPACK indexed-reference amplification + flow-control stall. A high school student's full protocol analysis (LaTeX). CVE-2026-49975, CVE-2026-47774.
http2-bomb amplification-attack dos-attack hpack http2 security-research vulnerability web-security cve-2026-47774 cve-2026-49975
TeX
Updated: 1 month, 1 week ago
1 stars
0 fork
0 watcher
Born at : June 13, 2026, 3:50 a.m.
This repo has been linked 1 different CVEs too.
HTTP2-Bomb
Updated: 1 month, 2 weeks ago
0 stars
0 fork
0 watcher
Born at : June 10, 2026, 5:06 a.m.
This repo has been linked 1 different CVEs too.
Disclosed on June 3, 2026, the "HTTP/2 Bomb" is an unauthenticated remote DoS that combines an HPACK compression bomb with a Slowloris-style hold to exhaust server memory. It affects default HTTP/2 configurations of **nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora**.
Shell
Updated: 1 month, 2 weeks ago
0 stars
0 fork
0 watcher
Born at : June 8, 2026, 2:44 p.m.
This repo has been linked 1 different CVEs too.
None
Shell
Updated: 1 month, 2 weeks ago
0 stars
0 fork
0 watcher
Born at : June 7, 2026, 5:31 a.m.
This repo has been linked 1 different CVEs too.
None
Python
Updated: 1 month, 2 weeks ago
0 stars
0 fork
0 watcher
Born at : June 5, 2026, 1:40 p.m.
This repo has been linked 3 different CVEs too.
Know when a CVE can actually be remediated in Red Hat Satellite.
Python
Updated: 1 month, 2 weeks ago
1 stars
0 fork
0 watcher
Born at : June 5, 2026, 12:58 p.m.
This repo has been linked 2 different CVEs too.
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-49975 vulnerability anywhere in the article.
-
The Hacker News
ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories
The internet did not break this week. It got used exactly as designed, which is worse.Searches were siphoned through shady browser add-ons. AI chat links turned into malware delivery paths. macOS atta ... Read more
Published Date:
Jun 18, 2026 (1 month ago)
The following table lists the changes that have been made to the
CVE-2026-49975 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Translation Title: Apache HTTP Server, Description: Vulnerabilidad de asignación de memoria con valor de tamaño excesivo en el mod_http del Servidor HTTP Apache conduce a denegación de servicio a través de solicitudes HTTP maliciosas. Este problema afecta al Servidor HTTP Apache: desde 2.4.17 hasta 2.4.67. -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jul. 15, 2026
Action Type Old Value New Value Changed Affected [{'cpes': ['cpe:/a:redhat:jboss_core_services:1::el7'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services on RHEL 7 Server', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services on RHEL 8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_aus:8.4::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream AUS (v.8.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus_long_life:8.4::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_aus:8.6::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream AUS (v.8.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus_long_life:8.6::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:8.8::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream E4S (v.8.8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_tus:8.8::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream TUS (v.8.8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:hummingbird:1'], 'vendor': 'Red Hat', 'product': 'Red Hat Hardened Images', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services 2.4.62.SP4', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:service_mesh:2.6::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Service Mesh 2.6', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_web_server:5'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Web Server 5', 'defaultStatus': 'unaffected'}] [{'cpes': ['cpe:/a:redhat:jboss_core_services:1::el8'], 'vendor': 'Red Hat', 'product': 'JBoss Core Services for RHEL 8', 'versions': [{'status': 'unaffected', 'version': '0:2.4.62-13.el8jbcs', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'jbcs-httpd24-httpd', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1::el8'], 'vendor': 'Red Hat', 'product': 'JBoss Core Services for RHEL 8', 'versions': [{'status': 'unaffected', 'version': '0:2.0.29-10.el8jbcs', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'jbcs-httpd24-mod_http2', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1::el7'], 'vendor': 'Red Hat', 'product': 'JBoss Core Services on RHEL 7', 'versions': [{'status': 'unaffected', 'version': '0:2.4.62-13.el7jbcs', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'jbcs-httpd24-httpd', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1::el7'], 'vendor': 'Red Hat', 'product': 'JBoss Core Services on RHEL 7', 'versions': [{'status': 'unaffected', 'version': '0:2.0.29-10.el7jbcs', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'jbcs-httpd24-mod_http2', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'versions': [{'status': 'unaffected', 'version': '0:2.0.29-4.el10_2.1', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'mod_http2', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'versions': [{'status': 'unaffected', 'version': '8100020260608081321.489197e6', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'httpd:2.4', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_aus:8.4'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support', 'versions': [{'status': 'unaffected', 'version': '8040020260702193120.522a0ee4', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'httpd:2.4', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus_long_life:8.4'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On', 'versions': [{'status': 'unaffected', 'version': '8040020260702193120.522a0ee4', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'httpd:2.4', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_aus:8.6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support', 'versions': [{'status': 'unaffected', 'version': '8060020260702195216.ad008a3a', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'httpd:2.4', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus_long_life:8.6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On', 'versions': [{'status': 'unaffected', 'version': '8060020260702195216.ad008a3a', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'httpd:2.4', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_tus:8.8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8.8 Telecommunications Update Service', 'versions': [{'status': 'unaffected', 'version': '8080020260702200145.63b34585', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'httpd:2.4', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:8.8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions', 'versions': [{'status': 'unaffected', 'version': '8080020260702200145.63b34585', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'httpd:2.4', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'versions': [{'status': 'unaffected', 'version': '0:2.0.26-6.el9_8.1', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'mod_http2', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services 2.4.62.SP4', 'versions': [{'status': 'unaffected', 'version': 'httpd24-httpd', 'lessThan': '*', 'versionType': 'rpm'}, {'status': 'unaffected', 'version': 'httpd24-mod_http2', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'jbcs', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:hummingbird:1'], 'vendor': 'Red Hat', 'product': 'Red Hat Hardened Images', 'versions': [{'status': 'unaffected', 'version': '2.4.68-1.hum1', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'httpd-main', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:service_mesh:2.6::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Service Mesh 2.6', 'versions': [{'status': 'unaffected', 'version': '1781604724', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'openshift-service-mesh/proxyv2-rhel9', 'collectionURL': 'https://catalog.redhat.com/software/containers/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-apache-commons-daemon', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-apache-commons-daemon-jsvc', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-apr', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-apr-util', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-brotli', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-compose', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-curl', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-dist', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-jansson', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-mod_cluster-native', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-mod_jk', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-mod_md', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-mod_proxy_cluster', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-mod_security', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-nghttp2', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-openssl', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-openssl-chil', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'packageName': 'jbcs-httpd24-openssl-pkcs11', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_web_server:5'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Web Server 5', 'packageName': 'jbcs-httpd24-apr', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_web_server:5'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Web Server 5', 'packageName': 'jbcs-httpd24-openssl', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}] -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jul. 09, 2026
Action Type Old Value New Value Added Reference https://access.redhat.com/errata/RHSA-2026:36831 Added Reference https://access.redhat.com/errata/RHSA-2026:36846 Changed Affected [{'cpes': ['cpe:/a:redhat:jboss_core_services:1::el7'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services on RHEL 7 Server', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services on RHEL 8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:8.8::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream E4S (v.8.8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_tus:8.8::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream TUS (v.8.8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:hummingbird:1'], 'vendor': 'Red Hat', 'product': 'Red Hat Hardened Images', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services 2.4.62.SP4', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:service_mesh:2.6::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Service Mesh 2.6', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_web_server:5'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Web Server 5', 'defaultStatus': 'unaffected'}] [{'cpes': ['cpe:/a:redhat:jboss_core_services:1::el7'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services on RHEL 7 Server', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services on RHEL 8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_aus:8.4::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream AUS (v.8.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus_long_life:8.4::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_aus:8.6::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream AUS (v.8.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus_long_life:8.6::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:8.8::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream E4S (v.8.8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_tus:8.8::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream TUS (v.8.8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:hummingbird:1'], 'vendor': 'Red Hat', 'product': 'Red Hat Hardened Images', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services 2.4.62.SP4', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:service_mesh:2.6::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Service Mesh 2.6', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_web_server:5'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Web Server 5', 'defaultStatus': 'unaffected'}] -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jul. 08, 2026
Action Type Old Value New Value Added Reference https://access.redhat.com/errata/RHSA-2026:36373 Changed Affected [{'cpes': ['cpe:/a:redhat:jboss_core_services:1::el7'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services on RHEL 7 Server', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services on RHEL 8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:hummingbird:1'], 'vendor': 'Red Hat', 'product': 'Red Hat Hardened Images', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services 2.4.62.SP4', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:service_mesh:2.6::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Service Mesh 2.6', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_web_server:5'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Web Server 5', 'defaultStatus': 'unaffected'}] [{'cpes': ['cpe:/a:redhat:jboss_core_services:1::el7'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services on RHEL 7 Server', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services on RHEL 8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:8.8::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream E4S (v.8.8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_tus:8.8::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream TUS (v.8.8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:hummingbird:1'], 'vendor': 'Red Hat', 'product': 'Red Hat Hardened Images', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services 2.4.62.SP4', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:service_mesh:2.6::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Service Mesh 2.6', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_web_server:5'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Web Server 5', 'defaultStatus': 'unaffected'}] -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jun. 30, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:/a:redhat:jboss_core_services:1::el7'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services on RHEL 7 Server', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services on RHEL 8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:hummingbird:1'], 'vendor': 'Red Hat', 'product': 'Red Hat Hardened Images', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services 2.4.62.SP4', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:service_mesh:2.6::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Service Mesh 2.6', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_core_services:1'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Core Services', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_web_server:5'], 'vendor': 'Red Hat', 'product': 'Red Hat JBoss Web Server 5', 'defaultStatus': 'unaffected'}] Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-409 Added Reference https://access.redhat.com/errata/RHSA-2026:25042 Added Reference https://access.redhat.com/errata/RHSA-2026:25057 Added Reference https://access.redhat.com/errata/RHSA-2026:25090 Added Reference https://access.redhat.com/errata/RHSA-2026:25225 Added Reference https://access.redhat.com/errata/RHSA-2026:27114 Added Reference https://access.redhat.com/errata/RHSA-2026:27200 Added Reference https://access.redhat.com/errata/RHSA-2026:27201 Added Reference https://access.redhat.com/security/cve/CVE-2026-49975 Added Reference https://bugzilla.redhat.com/show_bug.cgi?id=2485371 Added Reference https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49975.json -
Modified Analysis by [email protected]
Jun. 25, 2026
Action Type Old Value New Value Changed CPE Configuration OR *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* *cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:* versions up to (excluding) 1.29.8 *cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* versions from (including) 2.4.17 up to (excluding) 2.4.68 OR *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* *cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* versions from (including) 2.4.17 up to (excluding) 2.4.68 Added Reference Type CISA-ADP: https://github.com/EQSTLab/CVE-2026-49975 Types: Exploit, Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 18, 2026
Action Type Old Value New Value Added Reference https://github.com/EQSTLab/CVE-2026-49975 Changed SSVC {'id': 'CVE-2026-49975', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-09T15:25:51.036143Z'} {'id': 'CVE-2026-49975', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-18T10:27:36.270403Z'} -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-49975', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-09T15:25:51.036143Z'} -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Apache Software Foundation', 'product': 'Apache HTTP Server', 'versions': [{'status': 'affected', 'version': '2.4.17', 'versionType': 'semver', 'lessThanOrEqual': '2.4.67'}], 'defaultStatus': 'unaffected'}] -
Initial Analysis by [email protected]
Jun. 10, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* *cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:* versions up to (excluding) 1.29.8 *cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* versions from (including) 2.4.17 up to (excluding) 2.4.68 Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2026/06/03/3 Types: Mailing List, Third Party Advisory Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2026/06/08/16 Types: Mailing List, Third Party Advisory Added Reference Type Apache Software Foundation: https://httpd.apache.org/security/vulnerabilities_24.html Types: Vendor Advisory Added Reference Type CVE: https://lists.debian.org/debian-lts-announce/2026/06/msg00009.html Types: Mailing List, Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 09, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Jun. 08, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/06/08/16 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Jun. 08, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/06/03/3 Added Reference https://lists.debian.org/debian-lts-announce/2026/06/msg00009.html -
New CVE Received by [email protected]
Jun. 08, 2026
Action Type Old Value New Value Added Description Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67. Added CWE CWE-789 Added Reference https://httpd.apache.org/security/vulnerabilities_24.html
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.