CVE-2026-49975
HighAdvisory
Published 3 Jun 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.343
- 98th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 81
- of 17,781 indexed, latest versions
- Container images
- 80
- deployed by those charts
- Fix available
- 7 of 7
- affected packages
Apache HTTP Server: mod_http2 denial of service
Carried by container images the latest versions of 81 of 17,781 indexed charts deploy, on 80 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| apache2deb | 2.4.41-4ubuntu3.11, 2.4.41-4ubuntu3.12, 2.4.41-4ubuntu3.14, 2.4.41-4ubuntu3.17+14 more | 2.4.41-4ubuntu3.23+esm5, 2.4.52-1ubuntu4.21, 2.4.58-1ubuntu8.13, 2.4.67-1~deb12u3+1 more | 39 |
| nginxapk | 1.26.2-r4, 1.26.3-r0, 1.28.0-r3, 1.28.1-r1+4 more | 1.26.3-r1, 1.28.3-r3 | 14 |
| nginxdeb | 1.4.6-1ubuntu3.8ppa1, 1.18.0-0ubuntu1.2, 1.18.0-0ubuntu1.3, 1.18.0-0ubuntu1.4+6 more | 1.4.6-1ubuntu3.9+esm8, 1.18.0-0ubuntu1.7+esm3, 1.18.0-6ubuntu14.15, 1.24.0-2ubuntu7.12 | 13 |
| mod_http2rpm | 1.15.7-10.module+el8.10.0+23369+11a81384.4, 2.0.26-2.el9_4, 2.0.26-5.el9 | 0:1.15.7-10.module+el8.10.0+24368+ad388a0c.6, 0:2.0.26-6.el9_8.1 | 6 |
| apachebitnami | 2.4.54-157, 2.4.65-1, 2.4.68-1, 2.4.68-8 | 2.4.68 | 4 |
| apache2apk | 2.4.62-r0, 2.4.63-r4, 2.4.66-r0, 2.4.67-r0 | 2.4.68-r0 | 4 |
| httpdrpm | 2.4.37-43.module+el8.5.0+13806+b30d9eec.1, 2.4.37-56.module+el8.8.0+18758+b3a9c8da.6, 2.4.37-65.module+el8.10.0+23815+1b5e1c66.7 | 0:2.4.37-65.module+el8.10.0+24281+ea10630c.8 | 3 |
- OSV records
- ALPINE-CVE-2026-49975BIT-apache-2026-49975DEBIAN-CVE-2026-49975RHSA-2026:25057RHSA-2026:25090UBUNTU-CVE-2026-49975
- Also known as
- USN-8384-1, USN-8398-1, USN-8398-2, USN-8398-3, USN-8398-4, USN-8571-1
Charts affected
81 by stars
Container images carrying it
80 by charts deploying them
A fixed version is listed for 7 of the 7 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| library/ | 6e75aa8f767c | apache2 | 2.4.67-1~deb12u3 | 2 |
| library/ | 30bff39330d1 | apache2 | 2.4.67-1~deb13u3 | 2 |
| vdiogov/ | 6945f84f0058 | apache2 | 2.4.67-1~deb12u3 | 2 |
| yzhou442/ | a3f7ca69e28d | apache | 2.4.68 | 2 |
| akaunting/ | 52811b36ec3a | apache2 | 2.4.67-1~deb12u3 | 1 |
| awesometechnologies/ | a1c1f4662875 | nginx | 1.28.3-r3 | 1 |
| bitnamilegacy/ | f02c000c54b1 | apache | 2.4.68 | 1 |
| bitnami/ | 8448af086f92 | apache | 2.4.68 | 1 |
| cloudtooling/ | f4f04e0fc401 | apache | 2.4.68 | 1 |
| dgraziotin/ | 38f2de42bed0 | apache2 | 2.4.41-4ubuntu3.23+esm5 | 1 |
| dokuwiki/ | f08ecfdda239 | apache2 | 2.4.67-1~deb13u3 | 1 |
| dolibarr/ | 7ad88fc9b13c | apache2 | 2.4.67-1~deb12u3 | 1 |
| domainmod/ | 4017bfe4c597 | apache2 | 2.4.67-1~deb12u3 | 1 |
| dragonflyoss/ | edf3e921f4e0 | apache2 | 2.4.67-1~deb12u3 | 1 |
| extrim/ | 9cb7eb5598b6 | nginx | 1.26.3-r1 | 1 |
| fnzv/ | b3079b95c336 | nginx | 1.18.0-6ubuntu14.15 | 1 |
| galaxy/ | 8e577a626dfd | nginx | 1.4.6-1ubuntu3.9+esm8 | 1 |
| gulacedia/ | 67b467d961ca | apache2 | 2.4.67-1~deb12u3 | 1 |
| heartexlabs/ | aa461572e8f9 | nginx | 1.28.3-r3 | 1 |
| intel/ | 1a89327e499b | nginx | 1.18.0-0ubuntu1.7+esm3 | 1 |
| intelowlproject/ | 0b22e547ea6b | apache2 | 2.4.67-1~deb12u3 | 1 |
| jeboehm/ | 9da13edf5aa8 | nginx | 1.28.3-r3 | 1 |
| jhoncytech/ | 18c3ca1f411e | apache2 | 2.4.67-1~deb12u3 | 1 |
| kfirfer/ | 2efb4a5d74a3 | apache2 | 2.4.41-4ubuntu3.23+esm5 | 1 |
| library/ | 2415789e1602 | apache2 | 2.4.67-1~deb12u3 | 1 |
| library/ | 588609d76b21 | apache2 | 2.4.67-1~deb12u3 | 1 |
| library/ | b7faa1653c39 | apache2 | 2.4.67-1~deb13u3 | 1 |
| library/ | a8b39bd9cf0f | nginx | 1.28.3-r3 | 1 |
| library/ | 8ae66efb09a2 | apache2 | 2.4.67-1~deb12u3 | 1 |
| library/ | f73396626d2f | apache2 | 2.4.67-1~deb13u3 | 1 |
| linkstackorg/ | 1c8b05399ee4 | apache2 | 2.4.68-r0 | 1 |
| linuxserver/ | 2ebf97852661 | apache2 nginx | 2.4.68-r0 1.28.3-r3 | 1 |
| martinhelmich/ | c83a4f3fd7ae | apache2 | 2.4.67-1~deb12u3 | 1 |
| mautic/ | eb8cc73d97e1 | apache2 | 2.4.67-1~deb12u3 | 1 |
| mediagis/ | c15e941485ef | apache2 | 2.4.41-4ubuntu3.23+esm5 | 1 |
| mediagis/ | d0eae7b51374 | apache2 | 2.4.52-1ubuntu4.21 | 1 |
| mrasif/ | 375a1ed8fdc0 | nginx | 1.28.3-r3 | 1 |
| openstackhelm/ | f728510bab3c | apache2 | 2.4.41-4ubuntu3.23+esm5 | 1 |
| openstackhelm/ | e07d75953d2e | apache2 | 2.4.41-4ubuntu3.23+esm5 | 1 |
| owncloud/ | 51d9b74fc2a8 | apache2 | 2.4.41-4ubuntu3.23+esm5 | 1 |
| owncloud/ | 74c53d341076 | apache2 | 2.4.52-1ubuntu4.21 | 1 |
| phpmyadmin/ | 42a200db07b4 | apache2 | 2.4.67-1~deb13u3 | 1 |
| restic/ | d2aff06f47eb | apache2 | 2.4.68-r0 | 1 |
| seafileltd/ | 6693911bcc40 | nginx | 1.18.0-0ubuntu1.7+esm3 | 1 |
| seafileltd/ | 7ac833196f60 | nginx | 1.18.0-0ubuntu1.7+esm3 | 1 |
| seafileltd/ | ed0fcda5e6a9 | nginx | 1.18.0-0ubuntu1.7+esm3 | 1 |
| snipe/ | 141ebf2386fe | apache2 | 2.4.58-1ubuntu8.13 | 1 |
| snipe/ | 55fb7636a98c | apache2 | 2.4.41-4ubuntu3.23+esm5 | 1 |
| someblackmagic/ | 6eca64b6b440 | apache2 | 2.4.41-4ubuntu3.23+esm5 | 1 |
| sonroyaalmerol/ | 3f60f3abe990 | apache2 | 2.4.67-1~deb13u3 | 1 |