CVE•Published 2026-06-08•Modified 2026-06-09•0 articles on news•6 live references•NVD data

CVE-2026-49975

Vulnerability data via NVD (ingested)

CVSS v3.1

—

EPSS percentile

—

Weaknesses (CWE)

CWE-789Memory Allocation with Excessive Size Value

Description

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

Timeline

Published 2026-06-08

Modified 2026-06-09

External references

NVD MITRE Exploit-DB GitHub PoC Sploitus VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2026-49975

Hosts Shodan has explicitly fingerprinted as vulnerable.

More intel sources (5)

vuln:CVE-2026-49975

Country / ASN / product breakdown for the vuln query.

vulnerabilities.cve_id: CVE-2026-49975

Censys host search filtered to this CVE id.

CVE-2026-49975

Public source-code mentions — fast PoC discovery.

CVE-2026-49975

GitHub code search for direct mentions.

"CVE-2026-49975" exploit -site:nvd.nist.gov

Write-ups and news, NVD excluded.

Known PoCs on GitHub (8)

CVE-2026-499758 repos

nomi-sec/PoC-in-GitHubunknown

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

★ 7,813·updated today

mrx-arafat/CVE-2026-49975-POCPython

HTTP/2 Bomb PoC — CVE-2026-49975 (HPACK indexed reference bomb + flow-control stall)

★ 8·updated 5d ago

fevar54/Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-Python

Este repositorio contiene un Proof of Concept (POC) para CVE-2026-49975, también conocida como HTTP/2 Bomb, una vulnerabilidad de denegación de servicio (DoS) remoto que afecta a l…

★ 5·updated 5d ago

long-910/long-910unknown

★ 5·updated today

barmi/cve-patch-auditorGo

Audit CVE impact, patch status, remediation progress, and verification results across systems.

★ 3·updated 3d ago

Dragon-Lady/HereWeGoAgain-incident-scannerJavaScript

Here We Go Again” is an active npm/PyPI supply-chain worm, not just a credential stealer.

★ 2·updated 2d ago

denisfoulon/satellite-cve-monitorPython

Know when a CVE can actually be remediated in Red Hat Satellite.

★ 1·updated 3d ago

obrige/http2-bombHTML

CVE-2026-49975 HTTP/2 Stream Amplification — Docker PoC with Web Console

★ 1·updated 4d ago

We haven't classified any articles referencing CVE-2026-49975 yet. The external references above still apply.