Oracle Linux 10 mod_http2 DoS Vulnerabilities Disclosed

Oracle Linux 10 mod_http2 DoS Vulnerabilities Disclosed

First seen 20 Jul 2026, 23:09 UTC •Linuxsecurity •98% similarity •60.6

Article Content

Browse articles
ThreatCluster

Oracle has released advisories for multiple denial-of-service (DoS) vulnerabilities affecting mod_http2 in Oracle Linux 10. The vulnerabilities include CVE-2026-43951, CVE-2026-48913, and CVE-2026-49975, all published on 2026-06-08. CVE-2026-49975 specifically allows for remote DoS attacks via compression bomb and Slowloris-style techniques. The vulnerabilities impact Apache HTTP Server's mod_http2 module, which is crucial for handling HTTP/2 requests. Users are advised to update to the patched versions to mitigate these risks. The vulnerabilities could lead to significant service disruptions if exploited. The advisory emphasizes the importance of applying the updates promptly to safeguard systems.

Key Points: • Oracle Linux 10 mod_http2 has multiple DoS vulnerabilities disclosed. • CVE-2026-49975 allows remote DoS via compression bomb and Slowloris-style attacks. • Users are urged to apply patches immediately to prevent service disruptions.

ThreatCluster AI

Timeline

2025-07-10
CVE-2025-53020 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-06-04
First public PoC for CVE-2026-49975
A proof of concept for exploiting CVE-2026-49975 was made public, increasing the urgency for patching.
Linuxsecurity
2026-06-08
CVE-2026-43951, CVE-2026-48913, CVE-2026-49975 published
Oracle disclosed multiple DoS vulnerabilities in mod_http2 affecting Oracle Linux 10.
Linuxsecurity
2026-07-20
Oracle releases advisory for mod_http2 vulnerabilities
Oracle advises users to update to patched versions of mod_http2 to mitigate the disclosed vulnerabilities.
Linuxsecurity

Extracted Entities

1 / 2

Community

Browse all →