Bug 295842 - www/apache24: Patch CVE-2026-49975 (HTTP2 Bomb DoS)
Summary: www/apache24: Patch CVE-2026-49975 (HTTP2 Bomb DoS)
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Many People
Assignee: freebsd-apache (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-06-04 07:36 UTC by Dani I.
Modified: 2026-06-04 08:26 UTC (History)
2 users (show)

See Also:
bugzilla: maintainer-feedback? (apache)
i.dani: maintainer-feedback? (ports-secteam)


Attachments
Patch CVE-2026-49975 (1.87 KB, patch)
2026-06-04 07:36 UTC, Dani I.
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Dani I. 2026-06-04 07:36:04 UTC
Created attachment 271469 [details]
Patch CVE-2026-49975

There is a new vulnerability in Apache HTTPD: https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb

Assigned CVE: CVE-2026-49975

Patch: https://github.com/apache/httpd/commit/47d3100b252dc6668a9e46ae885242be9eeca9cd

We've built and tested the patch locally: The build worked fine and the CVE is fixed / Vuln can't be exploited anymore
Comment 1 commit-hook freebsd_committer freebsd_triage 2026-06-04 08:15:55 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=356bc43c9ad9a4d472648af0d0e9c33c3b5efa82

commit 356bc43c9ad9a4d472648af0d0e9c33c3b5efa82
Author:     Bernard Spil <brnrd@FreeBSD.org>
AuthorDate: 2026-06-04 08:13:44 +0000
Commit:     Bernard Spil <brnrd@FreeBSD.org>
CommitDate: 2026-06-04 08:15:04 +0000

    www/apache24: Security update for HTTP/2

    PR:             295842
    Reported by:    Dani I. <i dani outlook com>
    Security:       0d6d9d9b-5feb-11f1-8607-8447094a420f
    MFH:            2026Q2

 www/apache24/Makefile                         |  2 +-
 www/apache24/files/patch-CVE-2026-49975 (new) | 67 +++++++++++++++++++++++++++
 2 files changed, 68 insertions(+), 1 deletion(-)
Comment 2 Bernard Spil freebsd_committer freebsd_triage 2026-06-04 08:16:51 UTC
Thanks Dani!

People can also use www/mod_http2 as a mitigation, that's already at 2.0.42.
With the slew of LLM assisted security findings, it may be wise to pivot to the separate module. Note you have to modify your LoadModule for this to work!
Comment 3 Dani I. 2026-06-04 08:26:52 UTC
Thanks for the fast commit and heads-up regarding the separate port!

One thing regarding the patch-commit: I saw you also bumped the versions in "h2_version.h". IMHO thats not quite correct, as the stuff of 2.0.40 is currently missing and therefor it's not really v 2.0.41 and could be misleading. But in the end it's up to you how to handle that - i just wanted to point it out.. :)