AIKIDO-2026-11044
httpd is vulnerable to Resource Exhaustion
75
High Risk
This Affects:
httpdTL;DR
Apache httpd's bundled HTTP/2 implementation can merge split Cookie header fields without counting each crumb against the configured request-field limit. A client can combine HPACK indexed cookie fragments with a stalled response stream to keep large header allocations live. Affected servers can suffer remote memory exhaustion and availability loss through HTTP/2 requests. The 2.4.68 release includes mod_http2 2.0.41, which fixes cookie header accounting against LimitRequestFields.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and HTTP/2 is enabled.
Background info
httpd is vulnerable to Resource Exhaustion in versions 2.4.17 - 2.4.67.
How to fix this
Upgrade the httpd library to the patch version.
Links
github.com/apache/httpd/compare/2.4.67...2.4.68
httpd.apache.org/security/vulnerabilities_24.htmlopenwall.com/lists/oss-security/2026/06/03/3openwall.com/lists/oss-security/2026/06/08/16lists.debian.org/debian-lts-announce/2026/06/msg00009.htmlaccess.redhat.com/errata/RHSA-2026:25042access.redhat.com/errata/RHSA-2026:25057access.redhat.com/errata/RHSA-2026:25090access.redhat.com/errata/RHSA-2026:25225access.redhat.com/errata/RHSA-2026:27114access.redhat.com/errata/RHSA-2026:27200access.redhat.com/errata/RHSA-2026:27201access.redhat.com/errata/RHSA-2026:36373access.redhat.com/errata/RHSA-2026:36831access.redhat.com/errata/RHSA-2026:36846access.redhat.com/security/cve/CVE-2026-49975bugzilla.redhat.com/show_bug.cgi?id=2485371github.com/EQSTLab/CVE-2026-49975security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49975.json
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant