Back Linuxsecurity

Oracle Linux 9 mod_http2 Important Remote DoS Advisory ELSA-2026

Linuxsecurity •LinuxSecurity Advisories • June 25, 2026

[2.0.26-6.1] - Resolves: RHEL-182417 - mod_http2: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) [2.0.26-6] - Resolves: RHEL-166293 - httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020)

mod_http2-2.0.26-6.el9_8.1.x86_64.rpm

mod_http2-2.0.26-6.el9_8.1.aarch64.rpm

Related CVEs: CVE-2026-49975

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle Linux 9 Vulnerabilities Lead to Critical Security Advisories Oracle Linux 9 has issued two important advisories addressing critical vulnerabilities in the Apache HTTP Server. The first advisory (ELSA-2026-21391) details multiple CVEs, including CVE-2026-28780, which allows arbitrary code execution via a heap-based buffer overflow. Other vulnerabilities include CVE-2026-33007, a NULL pointer dereference, and CVE-2026-34059, which involves memory disclosure. The second advisory (ELSA-2026-25057) focuses on mod_http2, which is susceptible to a remote Denial of Service (DoS) attack via a compression bomb (CVE-2026-49975). Both advisories affect Oracle Linux 9 and require immediate attention from system administrators to mitigate risks. The vulnerabilities could potentially lead to service disruptions and unauthorized access if not patched promptly. 4 sources 73

Extracted Entities

Oracle Linux 9 mod_http2 Important Remote DoS Advisory ELSA-2026

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

Platforms (2)