CVE-2026-49975

Think of your web server like a bouncer at the door. This flaw lets a bad actor send a specially crafted request that tries to trick the server into allocating an unusually large amount of memory, which can overwhelm it and cause it to stop responding (or become very slow).

This matters to you if you use or host web services on Apache HTTP Server versions 2.4.17 through 2.4.67, because that specific range is affected. It also highlights broader web infrastructure stacks where Apache HTTP Server, and related web front-ends/reverse proxies (listed in the affected products), may be involved in delivering your site or APIs.

This is rated AMBER: serious impact (service disruption) but not shown as a broad, confirmed “known exploited” campaign yet. Press attention is rising and a proof-of-concept exists, which means attackers could start trying it, so you should prioritize patching on a schedule that fits your operations (rather than waiting for a later maintenance window).

1. Identify exposure: Confirm whether your public-facing web servers are running Apache HTTP Server 2.4.17 through 2.4.67 (including any instances in internal hosting, DMZ, or containers). 2) Patch: Upgrade Apache HTTP Server to a fixed release that is not in the affected range. Apply updates promptly and restart the service as required by your deployment process. 3) Mitigate if you can’t patch immediately: Reduce what the internet can reach—limit which virtual hosts and modules are enabled, and restrict inbound access so malicious requests are less likely to reach mod_http. If your setup allows it, prefer configuration changes that prevent the affected code path from being used. 4) Validate: After updating, test with normal traffic and confirm the server remains stable under typical load. 5) Monitor: Keep an eye on signs of denial of service such as spikes in resource use (memory/CPU), sudden increases in 5xx errors, or web server restarts. 6) Incident readiness: If you detect service instability, check logs for unusual request patterns and consider temporarily tightening access controls while patching.

Severity is described as high (denial of service). The weakness is Memory Allocation with Excessive Size Value in Apache HTTP Server’s mod_http, triggered by malicious HTTP requests that cause excessive memory allocation. Affected versions are 2.4.17 through 2.4.67. Press reports indicate a proof-of-concept exists (“poc_public”), but CISA KEV shows no known exploited in the wild and no public exploit is reported as available. EPSS is 1.3% estimated probability of exploitation in the next 30 days, and there is no Nuclei detection template yet—so defenders may rely on manual checks, server logs, and vendor guidance rather than ready-made scanning templates. Attack vector is network-based via crafted HTTP requests reaching the mod_http path; the likely outcome is service disruption from memory pressure leading to crashes or unresponsiveness.