Summary
It was discovered that Apache HTTP Server incorrectly handled certain
cookie headers in the HTTP/2 implementation. A remote attacker could
possibly use this issue to cause Apache HTTP Server to consume excessive
resources, resulting in a denial of service.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | apache2 | 2.4.52-1ubuntu4.21 |
| Ubuntu · 24.04 LTS 24.04:LTS | apache2 | 2.4.58-1ubuntu8.13 |
| Ubuntu · 25.10 | apache2 | 2.4.64-1ubuntu3.5 |
| Ubuntu · 26.04 LTS 26.04:LTS | apache2 | 2.4.66-2ubuntu2.2 |
References
-
report
https://ubuntu.com/security/CVE-2026-49975