FORTINET Security Advisory
Published Date: Not specified
CVE: CVE-2026-49975
Advisory Summary
🏷️ 〖 HTTP/2 Bomb — CVE-2026-49975 〗
Fortinet PSIRT highlights CVE-2026-49975 (CVSS v3 5.8) — a memory allocation with excessive size flaw in Apache HTTP Server’s mod_http, enabling Denial of Service (DoS) through crafted HTTP requests (often described in “HTTP/2 bomb” terms).
- Service degradation / downtime due to memory pressure
- Potential crash or resource exhaustion from malicious request patterns
- Affects Apache HTTP Server versions 2.4.17 through 2.4.67
- DoS-class issues can be exploited without authentication and may be triggered remotely.
- Even moderate CVSS doesn’t mean “low impact” for internet-facing web tiers—resource exhaustion can still take down services.
🛡️ 〖 Security actions (recommended) 〗
1. Upgrade Apache HTTP Server to a fixed release outside 2.4.17–2.4.67.
2. If upgrades are constrained, implement compensating controls immediately (rate limiting / WAF rules / request size & header limits) while patching is in progress.
3. Monitor for anomalous HTTP/2 traffic patterns and elevated memory usage on affected web instances.
4. Validate whether any upstream gateways/CDNs or load balancers pass through HTTP/2 traffic that still reaches Apache’s mod_http.
🔍 〖 Market / infrastructure takeaway 〗
This reinforces the ongoing theme in data center security: protocol-layer traffic abuse (HTTP/2 request patterns) remains a practical route to availability attacks. Infrastructure teams should treat web server updates and edge filtering as inseparable controls for modern ingress architectures.
-2026-49975
Reference: Vendor Advisory