CVE-2026-49975

HighCVSS 7.5/10Last modified Aug 19, 2026

Description

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.

This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-789CWE-409

Affected software

VendorProductVersions
Apache Software FoundationApache HTTP Server>= 2.4.17, <= 2.4.67
Red HatJBoss Core Services for RHEL 8—
Red HatJBoss Core Services for RHEL 8—
Red HatJBoss Core Services on RHEL 7—
Red HatJBoss Core Services on RHEL 7—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat JBoss Core Services 2.4.62.SP4—
Red HatRed Hat Hardened Images—
Red HatRed Hat OpenShift Service Mesh 2.6—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Web Server 5—
Red HatRed Hat JBoss Web Server 5—

References

Timeline

Published
Jun 8, 2026
Last modified
Aug 19, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-499766.5Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite thCVE-2026-499774.3tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with thCVE-2026-499786.1DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skipCVE-2026-499792.7Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpointCVE-2026-49987.3A weakness has been identified in Sinaptik AI PandasAI up to 3.0.0. This vulnerability affects the function CodeExecutor.execute of the fileCVE-2026-499809.8Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rcloCVE-2026-499818.2Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a TemplCVE-2026-499828.2tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values tCVE-2026-499835.2Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, environment access is gated by the env permission. You can deny iCVE-2026-499847.7Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates userCVE-2026-499867.1The Cortex MCP server (`neuro-cortex-memory`), a cross-platform persistent memory MCP, prior to version 3.17.1 treats the `CLAUDE_PROJECT_DICVE-2026-499878.8Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the
CVE-2026-49975: High severity, CVSS 7.5 | Vulnix