AIKIDO-2026-11043
mod_http2 is vulnerable to Resource Exhaustion
75
High Risk
This Affects:
mod_http2TL;DR
mod_http2 merges split HTTP/2 Cookie header fields but does not count merged cookie crumbs against LimitRequestFields. A client can send many HPACK-indexed cookie fragments and stall the response stream, causing Apache to repeatedly rebuild and retain large header allocations. Pre-fix servers can suffer remote memory exhaustion and availability loss through HTTP/2 requests. The fix treats merged cookie headers as added fields so they are limited by LimitRequestFields.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
mod_http2 is vulnerable to Resource Exhaustion in versions 2.0.0 - 2.0.40.
How to fix this
Upgrade the mod_http2 library to the patch version.
Links
GitHub Release
Other
httpd.apache.org/security/vulnerabilities_24.htmlopenwall.com/lists/oss-security/2026/06/03/3openwall.com/lists/oss-security/2026/06/08/16lists.debian.org/debian-lts-announce/2026/06/msg00009.htmlaccess.redhat.com/errata/RHSA-2026:25042access.redhat.com/errata/RHSA-2026:25057access.redhat.com/errata/RHSA-2026:25090access.redhat.com/errata/RHSA-2026:25225access.redhat.com/errata/RHSA-2026:27114access.redhat.com/errata/RHSA-2026:27200access.redhat.com/errata/RHSA-2026:27201access.redhat.com/errata/RHSA-2026:36373access.redhat.com/errata/RHSA-2026:36831access.redhat.com/errata/RHSA-2026:36846access.redhat.com/security/cve/CVE-2026-49975bugzilla.redhat.com/show_bug.cgi?id=2485371
github.com/EQSTLab/CVE-2026-49975security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49975.json
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant