Created attachment 271469 [details] Patch CVE-2026-49975 There is a new vulnerability in Apache HTTPD: https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb Assigned CVE: CVE-2026-49975 Patch: https://github.com/apache/httpd/commit/47d3100b252dc6668a9e46ae885242be9eeca9cd We've built and tested the patch locally: The build worked fine and the CVE is fixed / Vuln can't be exploited anymore
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=356bc43c9ad9a4d472648af0d0e9c33c3b5efa82 commit 356bc43c9ad9a4d472648af0d0e9c33c3b5efa82 Author: Bernard Spil <brnrd@FreeBSD.org> AuthorDate: 2026-06-04 08:13:44 +0000 Commit: Bernard Spil <brnrd@FreeBSD.org> CommitDate: 2026-06-04 08:15:04 +0000 www/apache24: Security update for HTTP/2 PR: 295842 Reported by: Dani I. <i dani outlook com> Security: 0d6d9d9b-5feb-11f1-8607-8447094a420f MFH: 2026Q2 www/apache24/Makefile | 2 +- www/apache24/files/patch-CVE-2026-49975 (new) | 67 +++++++++++++++++++++++++++ 2 files changed, 68 insertions(+), 1 deletion(-)
Thanks Dani! People can also use www/mod_http2 as a mitigation, that's already at 2.0.42. With the slew of LLM assisted security findings, it may be wise to pivot to the separate module. Note you have to modify your LoadModule for this to work!
Thanks for the fast commit and heads-up regarding the separate port! One thing regarding the patch-commit: I saw you also bumped the versions in "h2_version.h". IMHO thats not quite correct, as the stuff of 2.0.40 is currently missing and therefor it's not really v 2.0.41 and could be misleading. But in the end it's up to you how to handle that - i just wanted to point it out.. :)