CVE-2026-49975FortinetServers and softwareAugust 12, 2026

Fortinet: HTTP/2 Bomb CVE-2026-49975

Medium 5.8

Description

CVE-2026-49975: Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67. Revised on 2026-08-19 00:00:00

What to do

Install the fixed versions listed in the official advisory. If you cannot update right away, apply the workarounds or mitigations it describes and limit access to the affected service.

Running Fortinet devices? Get an email when a new vulnerability comes out. Free, unsubscribe in one click.
Turn on Fortinet alerts

Details

Vendor
Fortinet
Product
Apache HTTP Server
CVE
CVE-2026-49975
Affected versions
Apache HTTP Server 2.4: from 2.4.17 to 2.4.67 (from the advisory and NVD; check the exact builds in the official advisory)
CVSS score
5.8
Actively exploited
Not known at this time
Source
Fortinet PSIRT – original advisory
Published
August 12, 2026

The description and the recommended action are quoted from the public advisory (the action is our generic advice); severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.

More Fortinet advisories