HighCVE-2026-49975

    AMD EPYC™ 7002 Series Processors: Memory Allocation with Excessive Size Value (CVE-2026-49975)

    Published Sources: BSI

    What is affected, what to do

    Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

    An exploit is publicly available. Update Apache ActiveMQ to version 6.2.8, Apache ActiveMQ All to version 6.2.8, Apache ActiveMQ AMQP to version 6.2.8.

    Affected
    • Apache HTTP Server lte 2.4.17..2.4.67

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    7.5

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    7.5

    CVSS v3

    Severity High on the scale from 0 to 10.

    Source: BSI

    33.0 %

    EPSS score

    Elevated — model estimates 10-50% exploitation likelihood.

    Source: FIRST EPSS, percentile 98.4

    Show all metrics
    Severity
    High
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    84.18 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    PoC (publicly reported)
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    7.5 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    7.5
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    33.0 %
    Elevated — model estimates 10-50% exploitation likelihood.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    98.4
    Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    —
    Published
    CISA assessment (SSVC)
    Exploitation: proof of concept · automatable · Technical impact: partial
    Source: CISA Vulnrichment, as of 18 June 2026
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-789

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

    Source: BSI WID Portal

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    AMDAMD EPYC™ 7002 Series Processors
    • —
    • —
    AMDAMD EPYC™ Embedded 7002 Series Processors
    • —
    • —
    AMDAMD Ryzen Embedded V2000A Series Processors
    • —
    • —
    AMDAMD Ryzen™ 3000 Series Desktop Processors
    • —
    • —
    AMDAMD Ryzen™ 4000 Series Desktop Processors
    • —
    • —
    AMDAMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics
    • —
    • —
    AMDAMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics
    • —
    • —
    AMDAMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics
    • —
    • —
    AMDAMD Ryzen™ 7020 Series Processors with Radeon™ Graphics
    • —
    • —
    AMDAMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics
    • —
    • —
    AMDAMD Ryzen™ Embedded V2000 Series Processors
    • —
    • —
    AMDAMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors
    • —
    • —
    Apache Software FoundationApache ActiveMQ
    • 6.0.0 – < 6.2.8
    • < 5.19.9
    • 6.2.8
    • 5.19.9
    Apache Software FoundationApache ActiveMQ All
    • 6.0.0 – < 6.2.8
    • < 5.19.9
    • 6.2.8
    • 5.19.9
    Apache Software FoundationApache ActiveMQ AMQP
    • 6.0.0 – < 6.2.8
    • < 5.19.9
    • 6.2.8
    • 5.19.9
    Apache Software FoundationApache ActiveMQ Broker
    • 6.0.0 – < 6.2.8
    • < 5.19.9
    • 6.2.8
    • 5.19.9
    Apache Software FoundationApache HTTP Server
    • 2.4.0 – ≤ 2.4.67
    • 2.4.17 – ≤ 2.4.67
    • 2.4.55 – ≤ 2.4.67
    • ≤ 2.4.67
    • —
    • —
    • —
    • —
    Apache Software FoundationApache Struts
    • 2.0.0 – ≤ 2.3.37
    • 2.1.8 – ≤ 2.3.37
    • 2.5.0 – ≤ 2.5.33
    • 6.0.0 – ≤ 6.10.0
    • 7.0.0 – ≤ 7.2.1
    • —
    • —
    • —
    • —
    • —
    Apache Software FoundationApache Thrift
    • < 0.24.0
    • 0.24.0
    Apache Software FoundationApache Tomcat
    • 10.1.0-M1 – ≤ 10.1.57
    • 11.0.0-M1 – ≤ 11.0.24
    • 7.0.0 – ≤ 7.0.109
    • 7.0.30 – ≤ 7.0.109
    • 7.0.43 – ≤ 7.0.109
    • 7.0.97 – ≤ 7.0.109
    • 8.5.0 – ≤ 8.5.100
    • 8.5.46 – ≤ 8.5.100
    • 8.5.59 – ≤ 8.5.100
    • 9.0.0.M1 – ≤ 9.0.120
    • 9.0.25 – ≤ 9.0.120
    • 9.0.39 – ≤ 9.0.120
    • 9.0.42 – ≤ 9.0.120
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    attr projectattr
    • < 2.6.0
    • 2.6.0
    curlcurl
    • 7.30.0
    • 7.30.0 – < 8.14.2
    • 7.31.0
    • 7.32.0
    • —
    • 8.14.2
    • —
    • —
    Distribution and container packages (1)

    Downstream packages (e.g. Bitnami, Debian, Ubuntu, Red Hat). Versions refer to the distribution, not the vendor.

    Distribution and container packages
    Affected versionsFixed in
    bitnamisqlite
    • —
    • 3.53.2
    From bundled advisories, not CVE-specific (110)

    Product list of a bundled advisory that does not state which product this CVE affects.

    Products from bundled advisories
    Affected versionsFixed in
    —jackson-databind (FasterXML Jackson, Java)
    • com.fasterxml.jackson.core:jackson-databind 2.10.0 - 2.18.11
    • com.fasterxml.jackson.core:jackson-databind 2.19.0 - 2.21.7
    • com.fasterxml.jackson.core:jackson-databind 2.22.0 - 2.22.3
    • tools.jackson.core:jackson-databind 3.0.0 - 3.1.7
    • tools.jackson.core:jackson-databind 3.2.0 - 3.2.3
    • 2.18.12
    • 2.21.8
    • 2.22.4
    • 3.1.8
    • 3.2.4
    AmazonCorretto
    • < 11.0.32.10.1
    • < 8.504.01.1
    • 11.0.32.10.1
    • 8.504.01.1
    ApacheCamel
    • < 4.18
    • 4.18
    ApacheHTTP Server
    • < 2.4.68
    • 2.4.68
    AtlassianBamboo Data Center LTS
    • < 10.2.22
    • < 10.2.23
    • < 12.1.10
    • < 12.1.11
    • 10.2.22
    • 10.2.23
    • 12.1.10
    • 12.1.11
    AtlassianBamboo LTS
    • < 10.2.24
    • < 12.1.12
    • 10.2.24
    • 12.1.12
    AtlassianBitbucket
    • < 10.5.1
    • 10.5.1
    AtlassianBitbucket Data Center
    • < 10.4.2
    • < 10.4.3
    • 10.4.2
    • 10.4.3
    AtlassianBitbucket Data Center LTS
    • < 10.2.6
    • < 10.2.7
    • < 9.4.23
    • < 9.4.24
    • 10.2.6
    • 10.2.7
    • 9.4.23
    • 9.4.24
    AtlassianBitbucket LTS
    • < 10.2.8
    • < 9.4.26
    • 10.2.8
    • 9.4.26
    AtlassianConfluence
    • < 11.0.0
    • 11.0.0
    AtlassianConfluence Data Center LTS
    • < 10.2.15
    • < 10.2.17
    • < 10.2.18
    • < 9.2.23
    • < 9.2.24
    • < 9.2.25
    • 10.2.15
    • 10.2.17
    • 10.2.18
    • 9.2.23
    • 9.2.24
    • 9.2.25
    AtlassianConfluence LTS
    • < 10.2.19
    • < 9.2.26
    • 10.2.19
    • 9.2.26
    AtlassianCrucible
    • < 4.9.13
    • < 4.9.14
    • < 4.9.15
    • 4.9.13
    • 4.9.14
    • 4.9.15
    AtlassianFisheye
    • < 4.9.13
    • < 4.9.14
    • < 4.9.15
    • 4.9.13
    • 4.9.14
    • 4.9.15
    AtlassianJira Data Center LTS
    • < 10.3.24
    • < 10.3.25
    • < 11.3.10
    • < 11.3.11
    • 10.3.24
    • 10.3.25
    • 11.3.10
    • 11.3.11
    AtlassianJira LTS
    • < 10.3.26
    • < 11.3.12
    • 10.3.26
    • 11.3.12
    AtlassianJira Service Management Data Center LTS
    • < 10.3.25
    • < 11.3.11
    • 10.3.25
    • 11.3.11
    DellECS
    • 3.8.1.0-3.8.1.7
    • —

    Vendors and products

    Affected operating systems

    Affected operating systems
    Linuxdebianapache2bookworm
    Linuxdebianapache2bullseye
    Linuxdebianapache2trixie
    Linuxdebianbind9bookworm
    Linuxdebianbind9bullseye
    Linuxdebianbind9trixie
    Linuxubuntubind9bionic
    Linuxubuntubind9focal
    Linuxubuntubind9jammy
    Linuxubuntubind9noble
    Linuxubuntubind9resolute
    Linuxubuntubind9trusty
    Linuxubuntubind9xenial
    Linuxdebiancurltrixie
    Linuxdebiandebian_linux11.0
    Linuxubuntudracutbionic
    Linuxubuntudracutfocal
    Linuxubuntudracutjammy
    Linuxubuntudracutnoble
    Linuxubuntudracutresolute
    Linuxubuntudracutxenial
    Linuxredhatenterprise_linux10.0
    Linuxredhatenterprise_linux8.0
    Linuxredhatenterprise_linux7.0

    Weakness classes (CWE)

    • CWE-789Memory Allocation with Excessive Size Value

      Variant

      The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

      Entry at MITRE CWE-789

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    PoC-in-GitHub (nomi-sec)POC-CVE-2026-49975 (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)http2-bomb (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-49975 (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)http2-bomb-analysis-paper (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)http2-bomb-detector (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-49975 (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-49975 (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-49975 (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-49975-HTTP-2-Bomb (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)http2-bomb (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)CVE-2026-49975-POC (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb- (opens in a new tab)github.comPoC (publicly reported)reported, not verified

    References & sources

    Changes to this CVE

    Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

    1. Record modifiedRed Hat ADP

      Show 2 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Referenceadded
      —
      https://access.redhat.com/errata/RHSA-2026:55992
      Affected versions (publisher)changed
      JBoss Core Services for RHEL 8, JBoss Core Services for RHEL 8, JBoss Core Services on RHEL 7 (+35)
      JBoss Core Services for RHEL 8, JBoss Core Services for RHEL 8, JBoss Core Services on RHEL 7 (+37)

      Source identifier: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

    2. Record modifiedRed Hat ADP

      Show the original change
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Referenceadded
      —
      https://access.redhat.com/errata/RHSA-2026:55930

      Source identifier: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

    3. Record modifiedRed Hat ADP

      Show 3 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Referenceadded
      —
      https://access.redhat.com/errata/RHSA-2026:50538
      Referenceadded
      —
      https://access.redhat.com/errata/RHSA-2026:50572
      Affected versions (publisher)changed
      JBoss Core Services for RHEL 8, JBoss Core Services for RHEL 8, JBoss Core Services on RHEL 7 (+33)
      JBoss Core Services for RHEL 8, JBoss Core Services for RHEL 8, JBoss Core Services on RHEL 7 (+35)

      Source identifier: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

    4. Record modifiedRed Hat ADP

      Show 3 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Referenceadded
      —
      https://access.redhat.com/errata/RHSA-2026:36831
      Referenceadded
      —
      https://access.redhat.com/errata/RHSA-2026:36846
      Affected versions (publisher)changed
      Red Hat JBoss Core Services on RHEL 7 Server, Red Hat JBoss Core Services on RHEL 8, Red Hat Enterprise Linux AppStream (v. 10) (+9)
      Red Hat JBoss Core Services on RHEL 7 Server, Red Hat JBoss Core Services on RHEL 8, Red Hat Enterprise Linux AppStream (v. 10) (+13)

      Source identifier: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

    5. Initial analysis by NVDNVD

      Newly listed as affected:
      Show 5 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Product configurationadded
      —
      OR *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* *cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:* versions up to (excluding) 1.29.8 *cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* versions from (including) 2.4.17 up to (excluding) 2.4.68
      Reference typeadded
      —
      CVE: http://www.openwall.com/lists/oss-security/2026/06/03/3 Types: Mailing List, Third Party Advisory
      Reference typeadded
      —
      CVE: http://www.openwall.com/lists/oss-security/2026/06/08/16 Types: Mailing List, Third Party Advisory
      Reference typeadded
      —
      Apache Software Foundation: https://httpd.apache.org/security/vulnerabilities_24.html Types: Vendor Advisory
      Reference typeadded
      —
      CVE: https://lists.debian.org/debian-lts-announce/2026/06/msg00009.html Types: Mailing List, Third Party Advisory

      Source identifier: nvd@nist.gov

    Show 3 older changes

    1. Record modifiedCVE Program

      Show the original change
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Referenceadded
      —
      http://www.openwall.com/lists/oss-security/2026/06/08/16

      Source identifier: af854a3a-2127-422b-91ae-364da2661108

    2. Record modifiedCVE Program

      Show 2 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Referenceadded
      —
      http://www.openwall.com/lists/oss-security/2026/06/03/3
      Referenceadded
      —
      https://lists.debian.org/debian-lts-announce/2026/06/msg00009.html

      Source identifier: af854a3a-2127-422b-91ae-364da2661108

    3. ReceivedApache

      Weakness type: CWE-789

      Description added or changed

      Show 3 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Descriptionadded
      —
      Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
      Weakness type (CWE)added
      —
      CWE-789
      Referenceadded
      —
      https://httpd.apache.org/security/vulnerabilities_24.html

      Source identifier: security@apache.org

    One NVD translation into another language is hidden.

    Linked CVEs

    Linked CVEs
    CriticalCVE-2026-9323Insecure PRNG and Information Exposure in urwid Web Display Backend8.1—
    CriticalCVE-2026-8763Name Constraints bypass via trailing dot in rfc822Name and URI9.1—
    MediumCVE-2026-83557FasterXML Jackson-databind: Deserialization of Untrusted Data5.6—
    HighCVE-2026-8286wrong STARTTLS connection reuse8.1—
    MediumCVE-2026-77310FasterXML Com.fasterxml.jackson.core:jackson-databind: Server-Side Request Forgery (SSRF)5.3—
    MediumCVE-2026-74581Linux Kernel: Use-After-Free4.4—
    HighCVE-2026-73635Apache Struts: Unbounded growth of localized-text caches driven by the request locale7.5—
    HighCVE-2026-73634Apache Struts: Unbounded read of a Content Security Policy violation report7.5—
    HighCVE-2026-73633Apache Struts: Unbounded read of a JSON request body7.5—
    MediumCVE-2026-73180Apache Tomcat: Authenticated WebSocket session survives end of HTTP session6.8—
    MediumCVE-2026-70907IBM DataPower Gateway: Improper Access Control5.3—
    HighCVE-2026-70906Oracle Java SE: Uncontrolled Resource Consumption7.5—
    HighCVE-2026-68763Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset7.5—
    HighCVE-2026-68569Apache Tomcat: Principal lookup can fail open in some cases8.1—
    CriticalCVE-2026-68525Apache Tomcat: Redirect after FORM auth may bypass method specific constraints9.1—
    HighCVE-2026-68494FasterXML Jackson-core: Allocation of Resources Without Limits or Throttling——
    HighCVE-2026-68480Linux Kernel: security vulnerability8.8—
    MediumCVE-2026-68388Linux Kernel: Out-of-Bounds Access4.4—
    HighCVE-2026-66422Apache Tomcat: Servlet role references can bypass declarative role constraints8.1—
    HighCVE-2026-65927Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control7.5—
    CriticalCVE-2026-65905Apache Tomcat: Limited replay attack possible with DIGEST authentication9.8—
    HighCVE-2026-65183Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets8.1—
    CriticalCVE-2026-65182Apache Tomcat: Bypass longest prefix security constraint9.1—
    HighCVE-2026-64496Linux Kernel: Out-of-Bounds Read7.1—
    Show 130 more CVEs
    Linked CVEs
    HighCVE-2026-64379Linux Kernel: security vulnerability7.1—
    CriticalCVE-2026-64320Linux Kernel: Out-of-bounds Read9.1—
    HighCVE-2026-64298Linux Kernel: security vulnerability7.8—
    HighCVE-2026-64277Linux Kernel: Out-of-bounds Read7.8—
    HighCVE-2026-64276Linux Kernel: Out-of-bounds Write7.8—
    CriticalCVE-2026-64268Linux Kernel: Out-of-Bounds Access9.8—
    HighCVE-2026-64219Linux Kernel: Stack-Based Buffer Overflow7.1—
    HighCVE-2026-64191Linux Kernel: Out-of-Bounds Access7.8—
    HighCVE-2026-64189Linux Kernel: Use-After-Free7.8—
    HighCVE-2026-64048Linux Kernel: NULL Pointer Dereference7.5—
    CriticalCVE-2026-64018Linux Kernel: Out-of-Bounds Access9.3—
    HighCVE-2026-63913Linux Kernel: Improper Input Validation8.2—
    CriticalCVE-2026-63888Linux Kernel: Double Free9.8—
    CriticalCVE-2026-63887Linux Kernel: Heap-based Buffer Overflow9.8—
    CriticalCVE-2026-63886Linux Kernel: Heap-based Buffer Overflow9.8—
    HighCVE-2026-63884Linux Kernel: Use After Free7.8—
    HighCVE-2026-63879Linux Kernel: Race Condition7.8—
    CriticalCVE-2026-63800Linux Kernel: Use-After-Free9.8—
    MediumCVE-2026-61487Apache ActiveMQ Broker: Improper Authorization6.5—
    MediumCVE-2026-61308IBM DataPower Gateway: Improper Access Control6.8—
    LowCVE-2026-60589IBM DataPower Gateway: Exposure of Sensitive Information to an Unauthorized Actor3.7—
    MediumCVE-2026-59949Yawkat Lz4-java: NULL Pointer Dereference6.5—
    MediumCVE-2026-59888jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy6.5—
    HighCVE-2026-59878Apache ActiveMQ AMQP: Improper Input Validation7.5—
    HighCVE-2026-59850Libssh: libssh: use-after-free via data callbacks on closed channels7.5—
    MediumCVE-2026-59848Libssh: libssh: denial of service via sftp responses with unknown request ids5.3—
    HighCVE-2026-59847Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification7.5—
    LowCVE-2026-59846Libssh: libssh: information disclosure via proxycommand %r username expansion3.9—
    MediumCVE-2026-59845Libssh: libssh: denial of service via unchecked proxycommand fork() failure5.9—
    MediumCVE-2026-59844Libssh: libssh: denial of service via oversized sftp read length6.5—
    MediumCVE-2026-59843Libssh: libssh: denial of service via zero advertised channel packet size6.5—
    MediumCVE-2026-59652LDAP filter injection in legacy jdk1.4 LDAPStoreHelper6.5—
    HighCVE-2026-59651BKS keystore accepts legacy version with 16-bit integrity MAC key7.5—
    CriticalCVE-2026-59650MTI/A0 DH agreement exponentiates unvalidated peer value9.1—
    MediumCVE-2026-59648OpenPGP Argon2 S2K honours attacker-chosen memory and passes5.3—
    MediumCVE-2026-59647CRMF/CMP password-MAC honours unbounded iteration count5.3—
    HighCVE-2026-59645OER parser recurses without depth limit on self-referential IEEE 1609.2 schema7.5—
    HighCVE-2026-59642CMS AuthenticatedData content not bound to MAC when authAttrs present7.5—
    HighCVE-2026-59639CMS verifySignatures returns true for SignedData with zero signers7.5—
    HighCVE-2026-58472GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encoding7.1—
    HighCVE-2026-58471GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in url.c7.1—
    HighCVE-2026-58469GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsing7.5—
    MediumCVE-2026-58063BCFKS keystore load honours unbounded KDF cost from untrusted file5.3—
    CriticalCVE-2026-58062Stapled OCSP response accepted without binding to the checked certificate9.1—
    HighCVE-2026-58061CCM-family modes write plaintext to caller buffer before tag check7.5—
    HighCVE-2026-58060HSS public-key level count unbounded, enabling huge allocation on verify7.5—
    HighCVE-2026-58059Quadratic-time escaping when stringifying X.500 distinguished names7.5—
    MediumCVE-2026-58055nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length5.4—
    HighCVE-2026-58015GNOME GLib: Path Traversal7.5—
    HighCVE-2026-58014Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"8.6—
    HighCVE-2026-58013Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"8.2—
    HighCVE-2026-58012Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()8.2—
    HighCVE-2026-58011Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime7.5—
    HighCVE-2026-58010Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()8.2—
    HighCVE-2026-55995Double-free in the iSNS attribute decoder in open-iscsi——
    MediumCVE-2026-54515jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties5.3—
    MediumCVE-2026-54514jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)5.3—
    HighCVE-2026-54513FasterXML Jackson-databind: Incomplete List of Disallowed Inputs8.1—
    HighCVE-2026-54512FasterXML Jackson-databind: Incomplete List of Disallowed Inputs8.1—
    MediumCVE-2026-54411Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison5.9—
    HighCVE-2026-54371attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr7.1—
    CriticalCVE-2026-53399Linux Kernel: security vulnerability9.8—
    HighCVE-2026-53397Linux Kernel: security vulnerability7.5—
    HighCVE-2026-53392Linux Kernel: NULL Pointer Dereference7.5—
    HighCVE-2026-53391Linux Kernel: NULL Pointer Dereference7.5—
    CriticalCVE-2026-53374Linux Kernel: security vulnerability9.8—
    HighCVE-2026-53329Linux Kernel: security vulnerability7.1—
    HighCVE-2026-53189Linux Kernel: security vulnerability7.8—
    HighCVE-2026-53185Linux Kernel: Use-After-Free7.8—
    HighCVE-2026-53136Linux Kernel: Out-of-Bounds Access7.1—
    HighCVE-2026-53016Linux Kernel: Out-of-bounds Write7.8—
    HighCVE-2026-53009Linux Kernel: Use After Free7.8—
    CriticalCVE-2026-52991Linux Kernel: Time-of-check Time-of-use (TOCTOU) Race Condition9.8—
    CriticalCVE-2026-52924Linux Kernel: Use-After-Free9.8—
    HighCVE-2026-49975Apache HTTP Server: mod_http2 denial of service7.5—
    HighCVE-2026-48913Apache HTTP Server: mod_http2 memory corruption when file handles exhausted7.3—
    HighCVE-2026-48586Apache Thrift: Improper Handling of Highly Compressed Data (Data Amplification)7.5—
    HighCVE-2026-46120Linux Kernel: Use-After-Free7.8—
    HighCVE-2026-45991Linux Kernel: Out-of-Bounds Write7.8—
    HighCVE-2026-45970Linux Kernel: Use-After-Free7.8—
    HighCVE-2026-44690Cross-zone wildcard cache poisoning via RRSIG.labels manipulation7.5—
    CriticalCVE-2026-44631Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow9.4—
    MediumCVE-2026-44186Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp6.5—
    HighCVE-2026-44185Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`7.3—
    MediumCVE-2026-44119Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules5.5—
    MediumCVE-2026-43951Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash6.5—
    HighCVE-2026-43871Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit7.5—
    HighCVE-2026-43206Linux Kernel: Out-of-Bounds Write7.8—
    HighCVE-2026-42536Apache HTTP Server: mod_xml2enc heap overflow7.5—
    HighCVE-2026-42535Apache HTTP Server: mod_dav_fs protected directory access7.5—
    MediumCVE-2026-41989GnuPG Libgcrypt: Out-of-bounds Write6.7—
    HighCVE-2026-34356Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow7.5—
    HighCVE-2026-34355Apache HTTP Server: mod_proxy_html buffer overflow7.5—
    MediumCVE-2026-29170Apache HTTP Server: mod_proxy_ftp XSS6.1—
    HighCVE-2026-29167Apache HTTP Server: mod_ldap per-dir use-after-free8.6—
    MediumCVE-2026-18401FasterXML Jackson-core: Allocation of Resources Without Limits or Throttling——
    HighCVE-2026-17523Linux Kernel: security vulnerability7.8—
    HighCVE-2026-16529Pcp: pcp: denial of service due to signed integer overflow7.5—
    HighCVE-2026-16527Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules7.3—
    HighCVE-2026-16526Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability8.8—
    HighCVE-2026-16524Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection7.8—
    MediumCVE-2026-16440Eclipse OpenJ9: Uncontrolled Recursion——
    HighCVE-2026-16313Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export7.6—
    HighCVE-2026-15816Red Hat: OS Command Injection7.5—
    MediumCVE-2026-15588Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering5.3—
    HighCVE-2026-15055PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input8.2—
    HighCVE-2026-14682Possible OOM from unbounded up-front allocation on a definite-length read7.5—
    HighCVE-2026-13586PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)7.5—
    HighCVE-2026-13506Lazy ASN.1 sequence forcing resets nesting-depth guard7.5—
    HighCVE-2026-13321DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field8.6—
    HighCVE-2026-13204Unexpected exit in certain situations with NSEC and NSEC3 both present7.5—
    HighCVE-2026-12860RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path5.3—
    HighCVE-2026-12816IESEngine stream-mode MAC forgery via length-dependent KDF split7.5—
    HighCVE-2026-12803KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)7.5—
    HighCVE-2026-12802CMS AuthEnvelopedData fails to enforce tag-length on decryption7.5—
    HighCVE-2026-12185BKS/UBER keystore allocates from untrusted lengths before integrity check8.6—
    HighCVE-2026-11979Stack-Based Buffer Overflow in libxml27.8—
    HighCVE-2026-11940tarfile extraction filter bypass allows escaping the destination directory——
    HighCVE-2026-11824SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate7.8—
    HighCVE-2026-11822SQLite before 3.53.2 Out-of-Bounds Read in FTS5 fts5LeafSeek5.5—
    HighCVE-2026-11721Cache poisoning possible with label count discrepancy, RRSIG, and wildcards7.5—
    HighCVE-2026-11622Potential memory usage beyond configured limits7.5—
    MediumCVE-2026-10805Red Hat Enterprise Linux 8: OS Command Injection6.7—
    MediumCVE-2026-10723Incorrect acceptance of NSEC3 records6.8—
    HighCVE-2025-71132Linux Kernel: security vulnerability7.5—
    HighCVE-2025-54518AMD: Improper Isolation of Shared Resources on System-on-a-Chip (SoC)7.0—
    HighCVE-2025-4330Extraction filter bypass for linking outside extraction directory7.5—
    HighCVE-2025-39902Linux Kernel: security vulnerability7.1—
    HighCVE-2024-57849Linux Kernel: Use-After-Free7.8—
    HighCVE-2024-56602Linux Kernel: Use-After-Free7.8—

    Linked advisories

    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2026-49975
    <a href="https://intel.neosec.eu/en/cve/CVE-2026-49975"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-49975.svg?lang=en" alt="CVE-2026-49975 – NEOSEC Intel" height="20"></a>