High ALAS2-2026-3372 1 CVE

Important: mod_http2 security update (Amazon Linux 2)

Published Jun 22, 2026 · Updated Jun 22, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-49975: Denial of service in HTTP/2 cookie request header counting

Fixed packages 2

Release	Package	Fixed in
Amazon Linux · 2	mod_http2	0:2.0.42-1.amzn2.0.1
Amazon Linux · 2	mod_http2-debuginfo	0:2.0.42-1.amzn2.0.1

Vulnerabilities 1

High 7.5

CVE-2026-49975 Public exploit EPSS 33%

Apache HTTP Server: mod_http2 denial of service

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Jun 8, 2026

References

web
https://alas.aws.amazon.com/cve/html/CVE-2026-49975.html