Back Linuxsecurity

Oracle Linux 10 mod_http2 Important DoS Vulnerability ELSA-2026

Linuxsecurity •LinuxSecurity Advisories • July 20, 2026

Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges ×

[2.0.29-4.2] - Resolves: RHEL-188008 - address CVE-2026-43951, CVE-2026-48913 [2.0.29-4.1] - Resolves: RHEL-182410 - mod_http2: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) [2.0.29-4] - Resolves: RHEL-166269 - httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020)

mod_http2-2.0.29-4.el10_2.2.x86_64.rpm

mod_http2-2.0.29-4.el10_2.2.aarch64.rpm

Related CVEs: CVE-2026-49975

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle Linux 10 mod_http2 DoS Vulnerabilities Disclosed Oracle has released advisories for multiple denial-of-service (DoS) vulnerabilities affecting mod_http2 in Oracle Linux 10. The vulnerabilities include CVE-2026-43951, CVE-2026-48913, and CVE-2026-49975, all published on 2026-06-08. CVE-2026-49975 specifically allows for remote DoS attacks via compression bomb and Slowloris-style techniques. The vulnerabilities impact Apache HTTP Server's mod_http2 module, which is crucial for handling HTTP/2 requests. Users are advised to update to the patched versions to mitigate these risks. The vulnerabilities could lead to significant service disruptions if exploited. The advisory emphasizes the importance of applying the updates promptly to safeguard systems. 3 sources 61

Extracted Entities

Oracle Linux 10 mod_http2 Important DoS Vulnerability ELSA-2026

The full story

Extracted Entities

Attack Types (1)

CVEs (4)

Platforms (3)