Critical Security Update for Apache HTTP Server (httpd): Remote Denial of Service Vulnerability
Summary
ALSA-2026:25090: Important: httpd:2.4 security update. Affects httpd across 2 version ranges.
< 2.4.37-65.module_el8.10.0+4185+0955a0d7.8
< 2.4.37-65.module_el8.10.0+4190+704ad79b.8
Fixed in 2.4.37-65.module_el8.10.0+4185+0955a0d7.8 or 2.4.37-65.module_el8.10.0+4190+704ad79b.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache HTTP Server, commonly referred to as httpd, is a widely-used open-source web server software that provides a robust and efficient platform for hosting websites. It supports various features including HTTP/2, SSL/TLS, and dynamic content generation. However, recent vulnerabilities have been identified that could compromise its security, particularly concerning remote denial of service attacks.
Vulnerability Detail
The vulnerability identified as CVE-2026-49975 allows for a remote denial of service via a compression bomb and Slowloris-style attack. This can lead to significant service disruption, affecting the availability of web services hosted on the Apache HTTP Server. Attackers can exploit this vulnerability to overwhelm the server, causing it to become unresponsive and potentially leading to downtime for users.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update httpd-
< 2.4.37-65.module_el8.10.0+4185+0955a0d7.82.4.37-65.module_el8.10.0+4185+0955a0d7.8 -
< 2.4.37-65.module_el8.10.0+4190+704ad79b.82.4.37-65.module_el8.10.0+4190+704ad79b.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not possible, consider implementing rate limiting on incoming requests to mitigate the impact of potential attacks. Additionally, monitoring server logs for unusual activity can help identify and respond to attacks more swiftly.
Conclusion
The Apache HTTP Server has a critical vulnerability that requires immediate attention. By updating to the latest patched versions of the affected packages, you can protect your web services from potential denial of service attacks. Regular monitoring and timely updates are essential for maintaining the security of your server.
See every vulnerability recorded for httpd →
FAQ
CVE-2026-49975 is a vulnerability in the Apache HTTP Server that allows for remote denial of service attacks through a compression bomb and Slowloris-style techniques.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor vulnerabilities in real-time without requiring any installation.
Exploiting this vulnerability can lead to service disruptions, making your web services unavailable to users and potentially causing reputational damage.
Yes, implementing rate limiting on incoming requests and monitoring server logs for unusual activity can help mitigate risks until the patch is applied.
It is recommended to regularly check for updates and apply security patches as soon as they are available to ensure your systems remain secure.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
