Critical Security Update for mod_http2: Remote Denial of Service Vulnerability
Summary
ALSA-2026:25225: Important: mod_http2 security update. Affects mod_http2 versions < 2.0.29-4.el10_2.1. Fixed in 2.0.29-4.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mod_http2 module for Apache httpd is designed to implement the HTTP/2 protocol, enhancing web server performance and efficiency. It operates on top of libnghttp2 and is crucial for modern web applications that require faster data transmission. However, vulnerabilities in this module can lead to severe security risks, including denial of service attacks, which can disrupt service availability and affect user experience.
Vulnerability Detail
The vulnerability identified as CVE-2026-49975 allows for a Remote Denial of Service (DoS) attack through a compression bomb and Slowloris-style attack. This means that an attacker can exploit the HTTP/2 protocol's handling of requests to overwhelm the server, causing it to become unresponsive. The implications of this vulnerability are significant, as it can lead to service outages and affect the overall reliability of web applications relying on the mod_http2 module.
How To Fix
Minimum fixed version
2.0.29-4.el10_2.1
This is the first release that contains the fix.
sudo dnf update mod_http2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, administrators can limit the number of concurrent connections and requests to the server to mitigate the risk of exploitation until the package can be updated. This can be done by adjusting the server configuration settings in the Apache configuration file.
Conclusion
The mod_http2 module for Apache httpd has a critical vulnerability that can lead to remote denial of service attacks. It is crucial for users to update to the patched version to mitigate risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time, ensuring that your applications remain secure.
See every vulnerability recorded for mod_http2 →
FAQ
mod_http2 is an Apache module that enables the HTTP/2 protocol, allowing for improved performance and efficiency in web communications.
CVE-2026-49975 refers to a specific vulnerability in the mod_http2 module that allows for remote denial of service attacks.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing your manifest file. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Failing to address this vulnerability can lead to service outages, reduced availability for users, and potential exploitation by malicious actors.
It is recommended to regularly check for updates to your packages, ideally on a weekly basis, to ensure that you have the latest security patches and features.
Related vulnerabilities
Recent vulnerabilities recorded for mod_http2.
