CVE-2026-49975: Apache HTTP Server: mod_http2 denial of service

Synopsis

This is a denial-of-service vulnerability in Apache HTTP Server's mod_http2 module, affecting versions 2.4.17 through 2.4.67. An unauthenticated remote attacker can send a crafted HTTP request over the network to trigger an excessive memory allocation, requiring no prior access or user interaction. Successful exploitation crashes or exhausts the affected server process, making the service unavailable. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available as soon as Apache ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Apache HTTP Server over the network; the vulnerable module processes incoming HTTP/2 requests exposed on a standard network interface.

• AuthenticationNot required

  No credentials or account of any kind are needed; the malicious request can be sent by any unauthenticated client.

• Victim interactionNot required

  The attacker does not need any human on the target system to take an action; sending the crafted request alone triggers the vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental setup beyond network access to the server.

Blast Radius

• The affected Apache server process exhausts available memory or crashes, taking down all sites and virtual hosts served by that process.
• Legitimate HTTP and HTTPS traffic to the server is dropped for the duration of the attack, causing a full service outage for end users.
• If the server runs in a container without memory limits, the excessive allocation can spill into host-level resources and degrade co-located workloads.
• Availability impact is rated HIGH with no confidentiality or integrity component, so data is not read or modified, but service continuity is fully disrupted.