CVE-2026-49788
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network.
Risk Assessment
The attack may overload the HTTP/2 server, leading to unavailability of the organization's web services.
Recommendation
Update the HTTP/2 implementation to a version with resource allocation limits.
Other vulnerabilities in HTTP/2
See all- CVE-2023-45288High
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection; when a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, including Huffman-encoded data that is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames processed before closing a connection.
- CVE-2026-49160High
Uncontrolled resource consumption in HTTP/2 allows an unauthenticated attacker to perform a denial-of-service (DoS) attack over the network.
Original NVD description (English source)
Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS