Today, a critical denial-of-service (DoS) vulnerability, CVE-2026-49975, was disclosed in the mod_http module of Apache HTTP Server, a widely used web server software. This vulnerability could allow malicious HTTP requests to exhaust server resources, leading to service disruption. Versions 2.4.17 through 2.4.67 are currently affected, and developers are urged to take immediate action.
Vulnerability Overview and Scope of Impact
CVE-2026-49975 is a 'Memory Allocation with Excessive Size Value' vulnerability in Apache HTTP Server's mod_http. By sending specially crafted HTTP requests, attackers can cause the server to consume excessive memory, ultimately rendering it unable to process legitimate requests and leading to a denial-of-service state.
This vulnerability affects Apache HTTP Server versions 2.4.17 through 2.4.67. Internet-facing web servers and environments handling a large volume of traffic are particularly susceptible to significant impact.
Specific Impact and Attack Scenario
Attackers send specially crafted HTTP requests to the target Apache HTTP Server. This causes the mod_http module to attempt to allocate excessive memory, exhausting the server's memory resources. As a result, legitimate user access may time out, or the server may crash, leading to a successful denial-of-service attack. This poses a serious threat that directly impairs website availability.
Measures Engineers Should Take Immediately
The most recommended measure is to upgrade Apache HTTP Server to the latest patched version, 2.4.68 or later. If upgrading is difficult, temporary mitigation measures include limiting the request body size on a reverse proxy (e.g., Nginx) or restricting the maximum size of request headers/bodies within Apache's own configuration.
client_max_body_size 10M;
client_header_buffer_size 1k;
large_client_header_buffers 4 8k;
# 例: 継続的なDoS攻撃に対するレートリミット（Nginxのhttpブロック内）
limit_req_zone $binary_remote_addr zone=one:10m rate=5r/s;
server {
listen 80;
server_name your_domain.com;
location / {
limit_req zone=one burst=10 nodelay;
proxy_pass http://your_apache_backend;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}In the Nginx configuration example above, `client_max_body_size` limits the maximum size of the request body from clients, and the `limit_req_zone` and `limit_req` directives limit the request rate from specific IP addresses, thereby mitigating the risk of DoS attacks. It is also important to properly configure Apache directives such as `LimitRequestBody` and `LimitRequestFields`.
📦