HTTP/2 Bomb PoC Released for Apache HTTP Server DoS Vulnerability

A public proof-of-concept exploit is now available for CVE-2026-49975, an Apache HTTP Server denial-of-service vulnerability tied to the HTTP/2 Bomb attack technique. The flaw affects Apache HTTP Server versions 2.4.17 through 2.4.67 and is fixed in version 2.4.68, according to the official Apache HTTP Server advisory.

The vulnerability can let a remote, unauthenticated attacker exhaust server memory with malicious HTTP/2 requests. A successful attack can slow or interrupt legitimate traffic, especially on exposed web servers that have HTTP/2 enabled and have not received the latest Apache update.

The issue has drawn more attention because a working PoC was published in the EQSTLab GitHub repository. Administrators should treat this as an urgent patching priority, even though Apache rates the specific issue as moderate.

What CVE-2026-49975 means for Apache HTTP Server

CVE-2026-49975 is a memory allocation flaw in the HTTP/2 handling path of Apache HTTP Server. The NVD entry describes it as a Memory Allocation with Excessive Size Value vulnerability that can lead to denial of service through malicious HTTP requests.

The Apache issue is connected to the wider HTTP/2 Bomb research, which combines header compression behavior with stalled streams to hold memory for longer than expected. The original HTTP/2 Bomb disclosure said the attack class affected several major web server implementations, including Apache httpd.

For Apache deployments, the practical risk is service availability. Attackers do not need credentials, and vulnerable systems can consume large amounts of memory while trying to process crafted HTTP/2 traffic.

Item	Details
CVE	CVE-2026-49975
Nickname	HTTP/2 Bomb
Affected software	Apache HTTP Server 2.4.17 through 2.4.67
Fixed version	Apache HTTP Server 2.4.68 or later
Main impact	Remote denial of service through memory exhaustion
Authentication required	No

How the HTTP/2 Bomb attack works

HTTP/2 improves performance by allowing multiple streams over one connection and by compressing repeated request fields. The HTTP/2 specification explains that the protocol uses field compression, streams, multiplexing, and flow control to reduce latency and improve network use.

The problem in this case appears when an attacker sends a small HPACK-compressed HTTP/2 request that expands into many cookie header fields. During processing, Apache can be forced into repeated memory allocation while merging those cookie fields.

The attacker can then use HTTP/2 flow control to slow or stall the response path. That keeps affected streams open and prevents memory from being released quickly, which turns a small request into sustained pressure on the server.

Public PoC increases the patching pressure

The public PoC repository describes a test environment that demonstrates memory growth in a vulnerable Apache HTTP Server container. It also identifies Apache HTTP Server 2.4.68 or later as the patched version.

The PoC should not be treated as just a research artifact. Once exploit logic is public, scanners and attack tools can adapt quickly, especially for flaws that do not need authentication and affect internet-facing web infrastructure.

The CVE record also shows a CISA-ADP assessment that marks exploitation as PoC and automatable. That does not confirm widespread active exploitation, but it does make delayed patching more risky.

• Internet-facing Apache servers with HTTP/2 enabled should be checked first.
• Administrators should confirm whether installed packages include the Apache 2.4.68 fix or a vendor backport.
• Teams should avoid relying only on version strings when using Linux distribution packages.
• Memory spikes, stalled HTTP/2 streams, and abnormal connection patterns should be investigated.

Why this is a denial-of-service issue, not code execution

CVE-2026-49975 is primarily an availability bug. It can consume server memory and disrupt service, but the public descriptions do not identify it as a remote code execution flaw.

This distinction matters for incident response. The likely immediate impact is website or service outage, failed requests, degraded performance, container restarts, or worker exhaustion, rather than direct attacker control of the server.

Still, denial-of-service vulnerabilities can be serious for banks, healthcare portals, e-commerce sites, SaaS platforms, and public services. A short outage can cause operational damage, customer disruption, and secondary security pressure on support teams.

Risk area	Possible result
Memory usage	Apache processes or containers consume abnormal memory
Availability	Legitimate users see delays, failed requests, or outages
Operations	Load balancers may route traffic away from unhealthy nodes
Monitoring	Teams may see memory alerts before clear application errors
Incident response	Administrators may need to restart affected services under attack

Apache 2.4.68 is the main fix

The official Apache HTTP Server download page lists Apache HTTP Server 2.4.68 as the latest available version as of June 8, 2026. It also recommends that users move to the current 2.4.x branch.

Apache’s security page says CVE-2026-49975 was reported to the security team on May 26, fixed upstream in mod_h2 on May 27, fixed in the 2.4.x branch on June 2, and included in the 2.4.68 update released on June 8.

Organizations should patch through their normal vendor channel where possible. On Linux distributions, the package version may not always show 2.4.68 if the maintainer backported the security fix into an older package branch.

Temporary mitigations for unpatched systems

Where immediate patching is not possible, administrators can temporarily disable HTTP/2 on exposed Apache services that do not require it. This reduces exposure to the HTTP/2-specific attack path while teams prepare the full update.

That step should only be treated as a short-term mitigation. HTTP/2 often improves performance for legitimate traffic, and configuration changes can affect clients, proxies, and upstream applications if they are not tested.

The wider Calif research also shows that this attack class is not limited to a single vendor conceptually, so infrastructure teams should review other HTTP/2-capable components in the request path, including reverse proxies and load balancers.

• Upgrade Apache HTTP Server to 2.4.68 or apply the vendor backported fix.
• Disable HTTP/2 temporarily if it is not required and patching will take time.
• Set memory limits for containers and web server processes where appropriate.
• Monitor for unusual growth in Apache worker memory usage.
• Review reverse proxies, CDN settings, and load balancers for HTTP/2 exposure.
• Watch for many concurrent HTTP/2 streams that remain open longer than expected.

What security teams should monitor

Defenders should focus on behavior rather than waiting for a single signature. Suspicious signs include a sudden rise in Apache memory use, long-lived HTTP/2 connections, unusual numbers of concurrent streams, and traffic patterns that hold responses open.

Containerized environments may show the issue faster because memory limits can trigger restarts or out-of-memory kills. That can make the attack visible in platform logs before web server logs clearly show what happened.

The RFC 9113 HTTP/2 standard also includes denial-of-service considerations, which is a useful reminder that protocol features such as compression, multiplexing, and flow control need careful implementation limits in production software.

Who should act first

Organizations that expose Apache HTTP Server directly to the internet should prioritize this update. The same applies to teams running Apache behind a load balancer or reverse proxy if HTTP/2 traffic can still reach Apache.

Managed hosting providers, SaaS operators, public-sector portals, financial services, and e-commerce sites should review their Apache fleet quickly. High-traffic services face a larger operational impact if memory exhaustion takes servers out of rotation during peak hours.

The safest path remains clear: verify exposure, patch or apply the vendor fix, and use monitoring to detect memory pressure while changes roll out. The Apache 2.4.68 release gives administrators the fixed upstream version to target.

FAQ