{
  "threat_severity" : "Important",
  "public_date" : "2026-06-03T00:00:00Z",
  "bugzilla" : {
    "description" : "httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack",
    "id" : "2485371",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2485371"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-409",
  "details" : [ "Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.\nThis issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.", "A flaw was found in HTTP/2, affecting various web servers. A remote attacker can exploit this vulnerability by combining an HPACK compression bomb with a zero-byte flow-control window. This technique allows a small amount of data to expand into large memory allocations on the server, which are then held, leading to a denial of service (DoS) by rendering the server inaccessible." ],
  "statement" : "The Apache's `httpd` HTTP/2 protocol implementation has a denial-of-service (DoS) vulnerability that is rated as Important. An unauthenticated remote attacker can exploit this flaw by combining HPACK compression with flow control manipulation, leading to significant server memory exhaustion and rendering the service inaccessible. This vulnerability exists in default HTTP/2 configurations.",
  "affected_release" : [ {
    "product_name" : "JBoss Core Services for RHEL 8",
    "release_date" : "2026-06-22T00:00:00Z",
    "advisory" : "RHSA-2026:27200",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1::el8",
    "package" : "jbcs-httpd24-httpd-0:2.4.62-13.el8jbcs"
  }, {
    "product_name" : "JBoss Core Services for RHEL 8",
    "release_date" : "2026-06-22T00:00:00Z",
    "advisory" : "RHSA-2026:27200",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1::el8",
    "package" : "jbcs-httpd24-mod_http2-0:2.0.29-10.el8jbcs"
  }, {
    "product_name" : "JBoss Core Services on RHEL 7",
    "release_date" : "2026-06-22T00:00:00Z",
    "advisory" : "RHSA-2026:27200",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1::el7",
    "package" : "jbcs-httpd24-httpd-0:2.4.62-13.el7jbcs"
  }, {
    "product_name" : "JBoss Core Services on RHEL 7",
    "release_date" : "2026-06-22T00:00:00Z",
    "advisory" : "RHSA-2026:27200",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1::el7",
    "package" : "jbcs-httpd24-mod_http2-0:2.0.29-10.el7jbcs"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-06-11T00:00:00Z",
    "advisory" : "RHSA-2026:25225",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "mod_http2-0:2.0.29-4.el10_2.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-06-10T00:00:00Z",
    "advisory" : "RHSA-2026:25090",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "httpd:2.4-8100020260608081321.489197e6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-06-10T00:00:00Z",
    "advisory" : "RHSA-2026:25057",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "mod_http2-0:2.0.26-6.el9_8.1"
  }, {
    "product_name" : "Red Hat JBoss Core Services 2.4.62.SP4",
    "release_date" : "2026-06-22T00:00:00Z",
    "advisory" : "RHSA-2026:27201",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1",
    "package" : "jbcs-httpd24-httpd"
  }, {
    "product_name" : "Red Hat JBoss Core Services 2.4.62.SP4",
    "release_date" : "2026-06-22T00:00:00Z",
    "advisory" : "RHSA-2026:27201",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1",
    "package" : "jbcs-httpd24-mod_http2"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-10T00:00:00Z",
    "advisory" : "RHSA-2026:25042",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "httpd-main-2.4.68-1.hum1"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.6",
    "release_date" : "2026-06-18T00:00:00Z",
    "advisory" : "RHSA-2026:27114",
    "cpe" : "cpe:/a:redhat:service_mesh:2.6::el9",
    "package" : "openshift-service-mesh/proxyv2-rhel9:1781604724"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-apache-commons-daemon",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-apache-commons-daemon-jsvc",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-apr",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-apr-util",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-brotli",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-compose",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-curl",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-dist",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-jansson",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-mod_cluster-native",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-mod_jk",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-mod_md",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-mod_proxy_cluster",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-mod_security",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-nghttp2",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-openssl",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-openssl-chil",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-openssl-pkcs11",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-apr",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5",
    "fix_state" : "Not affected",
    "package_name" : "jbcs-httpd24-openssl",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-49975\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49975\nhttps://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb" ],
  "name" : "CVE-2026-49975",
  "mitigation" : {
    "value" : "See the security bulletin for a detailed mitigation procedure.",
    "lang" : "en:us"
  },
  "csaw" : false
}