CVE-2026-49160
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
Uncontrolled resource consumption in HTTP/2 allows an unauthenticated attacker to perform a denial-of-service (DoS) attack over the network.
Risk Assessment
An attacker can overload the server, causing service unavailability for legitimate users.
Recommendation
Apply security patches for the HTTP/2 implementation and implement connection rate limits.
Other vulnerabilities in HTTP/2
See all- CVE-2023-45288High
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection; when a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, including Huffman-encoded data that is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames processed before closing a connection.
- CVE-2026-49788High
Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network.
Original NVD description (English source)
Uncontrolled resource consumption in HTTP/2 allows an unauthorized attacker to deny service over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS