Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Apache HTTP Server HTTP/2 Denial of Service Risk

published 4 months ago
Summary

Apache HTTP Server 2.4 users should update their software to prevent a potential denial of service attack. This type of attack could cause a server to become unresponsive, making it unavailable to users. We recommend applying the latest security update to minimize the risk.

What to do
  • Update rocky httpd to version 0:2.4.37-65.module+el8.10.0+40045+6ce8579b.6.
  • Update rocky httpd to version 0:2.4.37-65.module+el8.10.0+40197+0231e209.8.
  • Update rocky httpd to version 0:2.4.37-65.module+el8.10.0+40053+5a18018e.7.
  • Update rocky httpd to version 0:2.4.37-65.module+el8.10.0+1840+b070a976.1.
  • Update rocky httpd to version 0:2.4.37-65.module+el8.10.0+1842+4a9649e8.2.
  • Update rocky httpd to version 0:2.4.37-65.module+el8.10.0+2061+8d03fdec.5.
  • Update rocky httpd to version 0:2.4.37-65.module+el8.10.0+1984+1bed3124.4.
  • Update rocky httpd to version 0:2.4.37-65.module+el8.10.0+1938+3b7755d4.3.
  • Update rocky httpd to version 0:2.4.37-65.module+el8.10.0+1830+22f0c9e0.
  • Update rocky mod_http2 to version 0:1.15.7-10.module+el8.10.0+40197+0231e209.5.
  • Update rocky mod_http2 to version 0:1.15.7-10.module+el8.10.0+2061+8d03fdec.4.
  • Update rocky mod_http2 to version 0:1.15.7-10.module+el8.10.0+1830+22f0c9e0.
  • Update rocky mod_http2 to version 0:1.15.7-10.module+el8.10.0+1938+3b7755d4.3.
  • Update rocky mod_http2 to version 0:1.15.7-10.module+el8.10.0+1883+38ed6c58.1.
  • Update rocky mod_http2 to version 0:1.15.7-10.module+el8.10.0+1775+6b057638.
  • Update rocky mod_md to version 1:2.0.8-8.module+el8.10.0+40053+5a18018e.2.
  • Update rocky mod_md to version 1:2.0.8-8.module+el8.9.0+1370+89cc8ad5.
Affected software
Ecosystem VendorProductAffected versions
Rocky Linux:8 rocky httpd < 0:2.4.37-65.module+el8.10.0+40045+6ce8579b.6
< 0:2.4.37-65.module+el8.10.0+40197+0231e209.8
< 0:2.4.37-65.module+el8.10.0+40053+5a18018e.7
< 0:2.4.37-65.module+el8.10.0+1840+b070a976.1
< 0:2.4.37-65.module+el8.10.0+1842+4a9649e8.2
< 0:2.4.37-65.module+el8.10.0+2061+8d03fdec.5
< 0:2.4.37-65.module+el8.10.0+1984+1bed3124.4
< 0:2.4.37-65.module+el8.10.0+1938+3b7755d4.3
< 0:2.4.37-65.module+el8.10.0+1830+22f0c9e0
Fix: upgrade to 0:2.4.37-65.module+el8.10.0+40045+6ce8579b.6
Rocky Linux:8 rocky mod_http2 < 0:1.15.7-10.module+el8.10.0+40197+0231e209.5
< 0:1.15.7-10.module+el8.10.0+2061+8d03fdec.4
< 0:1.15.7-10.module+el8.10.0+1830+22f0c9e0
< 0:1.15.7-10.module+el8.10.0+1938+3b7755d4.3
< 0:1.15.7-10.module+el8.10.0+1883+38ed6c58.1
< 0:1.15.7-10.module+el8.10.0+1775+6b057638
Fix: upgrade to 0:1.15.7-10.module+el8.10.0+40197+0231e209.5
Rocky Linux:8 rocky mod_md < 1:2.0.8-8.module+el8.10.0+40053+5a18018e.2
< 1:2.0.8-8.module+el8.9.0+1370+89cc8ad5
Fix: upgrade to 1:2.0.8-8.module+el8.10.0+40053+5a18018e.2
Original advisory text
Important: httpd:2.4 security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Timeline
Published11 Jun 2026
Updated11 Jun 2026
First seen11 Jun 2026
Sources
RLSA-2026:25090 · OSV
Track software like this
Free during beta