CVE-2026-49975

Strumento di riproduzione CVE-2026-49975 HTTP/2 Bomb Autore : polar bear Versione : 2.1 Vulnerabilità applicabile : CVE-2026-49975 bomba di memoria del protocollo HTTP/2 📖 Principio della vulnerabilità CVE-2026-49975 è una vulnerabilità di esaurimento della memoria nell'implementazione del...

http2-bomb

Bomba HTTP/2 — CVE-2026-49975 Amplificazione dello Stream HTTP/2 PoC · Docker · Console Web Vulnerabilità HTTP/2 consente di multiplexare più flussi su una singola connessione TCP. Questo PoC crea frame HEADERS appositamente formati contenenti un gran numero di riferimenti interni, costringendo i...

Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-

CVE-2026-49975 - HTTP/2 Bomb Proof of Concept Beschreibung CVE-2026-49975, auch bekannt als HTTP/2 Bomb , ist eine Remote-Denial-of-Service-Schwachstelle DoS, die die meisten gängigen Webserver in ihrer Standard-HTTP/2-Konfiguration betrifft. Die Schwachstelle wurde von OpenAI Codex entdeckt, ind...

Important: Red Hat Security Advisory: mod_http2 security update

An update for modhttp2 is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Vulnerability in Cosminexus HTTP Server

Overview VulnerabilityCVE-2026-49975 has been found in Cosminexus HTTP Server. This vulnerability does not apply if HTTP/2 protocol is disabled. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the...

Photon OS 5.0: Httpd PHSA-2026-5.0-91-0881

An update of the httpd package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0881. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Oracle Linux 10 : mod_http2 (ELSA-2026-25225)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-25225 advisory. - Resolves: RHEL-188008 - address CVE-2026-43951, CVE-2026-48913 - Resolves: RHEL-182410 - modhttp2: HTTP/2: Remote Denial of Service via compression bomb and...

MiracleLinux 9 : mod_http2-2.0.26-6.el9_8.1 (AXSA:2026-1306:02)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1306:02 advisory. httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 Tenable has extracted the preceding description block...

Important: Red Hat Security Advisory: httpd:2.4 security update

An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Commo...

Important: Red Hat Security Advisory: httpd:2.4 security update

An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

SUSE SLED15: apache2 / apache2-devel / apache2-event / apache2-manual / etc (SUSE-SU-2026:2759-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2759-1 advisory. This update for apache2 fixes the following issues - CVE-2026-29167: modldap per-dir use-after-free bsc1267976...

SUSE-SU-2026:2717-1 Security update for apache2

This update for apache2 fixes the following issues - CVE-2026-29167: modldap per-dir use-after-free bsc1267976. - CVE-2026-29170: modproxyftp XSS bsc1267977. - CVE-2026-34355: modproxyhtml buffer overflow bsc1267978. - CVE-2026-34356: malicious backend servers can lead to a heap-based buffer...

mod_http2 security update

2.0.26-6.1 - Resolves: RHEL-182417 - modhttp2: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 2.0.26-6 - Resolves: RHEL-166293 - httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase CVE-2025-53020...

Important: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP4 security update

Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 4 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: mod_http2

Issue Overview: Denial of service in HTTP/2 cookie request header counting CVE-2026-49975 Affected Packages: modhttp2 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Ru...

USN-8398-3: nginx vulnerability

USN-8398-1 fixed a vulnerability in nginx. The update caused a regression and was temporarily reverted in USN-8398-2. This update introduces a complete fix for CVE-2026-49975. We apologize for the inconvenience. Original advisory details: It was discovered that nginx incorrectly handled certain...

MiracleLinux 8 : httpd:2.4 (AXSA:2026-786:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-786:01 advisory. httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 Tenable has extracted the preceding description block...

AlmaLinux 10 : mod_http2 (ALSA-2026:25225)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:25225 advisory. httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 Tenable has extracted the preceding description block...

Exploit for Memory Allocation with Excessive Size Value in Apache Http_Server

http2-bomb-detector HTTP/2 Bomb CVE-2026-49975 Non-destru...

RLSA-2026:25225 Important: mod_http2 security update

The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 For more details about the security issues, including the impact, a...