Critical Security Update for mod_http2: Remote Denial of Service Vulnerability
Summary
ALSA-2026:25057: Important: mod_http2 security update. Affects mod_http2 versions < 2.0.26-6.el9_8.1. Fixed in 2.0.26-6.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mod_http2 module is an Apache HTTP server component that implements the HTTP/2 protocol, enhancing web performance through multiplexing and header compression. It is crucial for modern web applications that require efficient data transfer. However, this module is vulnerable to specific attacks that can lead to service disruptions.
Vulnerability Detail
The vulnerability identified as CVE-2026-49975 allows for a Remote Denial of Service (DoS) attack through a compression bomb and Slowloris-style techniques. Attackers can exploit this flaw to overwhelm the server, causing it to become unresponsive. This vulnerability arises from improper handling of HTTP/2 requests, which can lead to resource exhaustion and service outages.
How To Fix
Minimum fixed version
2.0.26-6.el9_8.1
This is the first release that contains the fix.
sudo dnf update mod_http2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable HTTP/2 support in your Apache configuration to mitigate the risk until the package is updated. This can be done by commenting out or removing the 'Protocols h2 http/1.1' line in your Apache configuration file.
Conclusion
The mod_http2 module is essential for leveraging the benefits of the HTTP/2 protocol, but it is currently vulnerable to a significant denial of service attack. It is crucial to update to the latest patched version to safeguard your server against potential threats. Utilize tools like Vulert to monitor your applications for vulnerabilities effectively.
See every vulnerability recorded for mod_http2 →
FAQ
mod_http2 is an Apache module that enables the HTTP/2 protocol, allowing for improved performance and efficiency in web communications.
CVE-2026-49975 refers to a specific vulnerability in mod_http2 that can lead to a Remote Denial of Service attack.
If exploited, this vulnerability can cause your server to become unresponsive, leading to downtime and potential loss of service for users.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider disabling HTTP/2 support as a temporary workaround to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for mod_http2.
