RHSA-2026:55930: Important: mod_http2 security update
Important: modhttp2 security update
Other sources
The modh2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.Security Fix(es): modhttp2: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020) httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) httpd: Apache HTTP Server: Out-of-bounds Read in modheaders and modmime (CVE-2026-43951) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
httpd (Apache HTTP Server)to a version that resolves this vulnerability.Patch CVE-2026-43951 - Upgrade
Upgrade
httpd (Apache HTTP Server)to a version that resolves this vulnerability.Patch CVE-2026-49975 - Upgrade
Upgrade
mod_http2 (Apache httpd)to a version that resolves this vulnerability.Patch CVE-2025-53020
Event History
Frequently Asked Questions
Which systems are in scope for this update?
Systems running Apache httpd with the mod_h2 module and HTTP/2 support are the relevant exposure area. The advisory applies to the listed Red Hat Enterprise Linux update, extended lifecycle, SAP, AUS, and architecture-specific offerings.
What access does an attacker need to exploit the denial-of-service issues?
The listed issues include remotely triggered HTTP/2 denial-of-service conditions, including memory increase and a compression-bomb or Slowloris-style attack. The advisory description does not state that authentication or prior local access is required.
Are default installations affected?
The provided advisory data does not say whether HTTP/2 or mod_h2 is enabled by default in any affected offering. Verify whether Apache httpd is deployed with mod_h2 and serves HTTP/2 or h2c.
What should be done if affected systems are externally reachable?
The provided data does not include temporary mitigations. Prioritize applying RHSA-2026:55930 to affected systems, particularly where HTTP/2 is exposed to remote clients.