What is the CVSS score of CVE-2026-59173?

CVE-2026-59173 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of HTTP/2 Servers are affected by CVE-2026-59173?

A critical memory exhaustion vulnerability in HTTP/2 server implementations allows unauthenticated remote attackers to trigger denial-of-service by manipulating flow-control conditions, forcing…

How to fix or mitigate CVE-2026-59173?

Within 24 hours: Inventory all HTTP/2 server implementations in production (web servers, load balancers, API gateways) and assess which systems accept external untrusted traffic. Identify and document vendors and versions affected by CVE-2026-59173, CVE-2026-59762, and CVE-2026-44909. Within 7 days: Deploy compensating controls including per-connection stream limits (recommend maximum 50-100 concurrent streams per client IP), aggressive idle connection timeouts (recommend 30-60 seconds), and explicit enforcement of SETTINGS_INITIAL_WINDOW_SIZE to minimum 16KB to prevent zero-window attacks. Configure logging and monitoring to alert on per-connection buffer exhaustion and anomalous stream accumulation patterns. Within 30 days: Subscribe to vendor security advisory feeds for patches tied to CERT VU#885548; stage and test patches in non-production environments immediately upon vendor release; update load balancer rules to detect and block connections exhibiting stalled flow-control patterns at ingress points.

HTTP/2 Servers CVE-2026-59173

EUVD-2026-45376 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-16

GHSA-6m23-f848-jcqf

Denial Of Service Apache Traffic Server

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, no authentication or user interaction needed, pure availability impact via memory exhaustion, no confidentiality or integrity effects.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.5 (HIGH)

Analysis Generated

Jul 16, 2026 - 20:23 vuln.today

CVE Published

Jul 16, 2026 - 19:27 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical DoS via HTTP/2 Memory Exhaustion in Mozilla - CVE-2026-59173 Jul 16, 2026

AnalysisAI

Memory exhaustion denial-of-service affects HTTP/2 server implementations that fail to cap buffered response data under stalled flow-control conditions. A remote unauthenticated attacker opens many simultaneous HTTP/2 streams while advertising SETTINGS_INITIAL_WINDOW_SIZE = 0 or withholding WINDOW_UPDATE frames, forcing the server to accumulate unbounded in-memory response buffers it cannot transmit. Under permissive resource limits this can trigger OOM kills, swap exhaustion, and full system unresponsiveness; under tighter limits, connection and worker pool exhaustion degrades availability for legitimate clients. Reported 2026-07-16 by Okta Red Team and coordinated as CERT VU#885548 covering at least three CVE IDs (CVE-2026-59762, CVE-2026-59173, CVE-2026-44909) across multiple vendor implementations. No public exploit code identified at time of analysis, and CISA KEV listing not confirmed.

Technical ContextAI

HTTP/2 (standardized in RFC 9113, which obsoletes RFC 7540 and RFC 8740) introduces per-stream and per-connection flow-control windows governed by WINDOW_UPDATE frames and the SETTINGS_INITIAL_WINDOW_SIZE parameter. The protocol permits a client to legally set the initial window size to zero, which freezes outbound data transfer on all open streams. Compliant but vulnerable server implementations continue processing incoming requests and generating complete response bodies even when the transmission window is exhausted, queuing response data in heap memory per stream. Because HTTP/2 multiplexes many streams over a single TCP connection, an attacker can hold hundreds of streams open simultaneously while keeping all windows at zero, causing per-stream buffer accumulation that is only released when the connection closes or a server-side timeout fires. The root cause class is resource exhaustion (functionally CWE-400: Uncontrolled Resource Consumption) arising from the protocol's legal but adversarially exploitable flow-control semantics - not a memory corruption or logic flaw per se. CWE was not formally assigned in the available input data. At least one vendor-specific advisory exists from F5 (K000162231), and the assignment of three separate CVE IDs implies distinct vulnerable codebases or configurations across different HTTP/2 server products.

RemediationAI

The primary remediation is to apply vendor-supplied patches for the specific HTTP/2 server implementation in use; consult the CERT VU#885548 vendor table at https://kb.cert.org/vuls/id/885548 for individual CVE assignments and fix versions, and the F5-specific advisory at https://my.f5.com/manage/s/article/K000162231 for F5 products. Exact patched version numbers are not available in the current input data for any vendor beyond the F5 reference. Where patching is not immediately possible, the advisory recommends three classes of compensating controls: enforcing per-connection and per-stream memory ceilings to cap buffered response data (trade-off: may cause legitimate slow clients to be disconnected); restricting the maximum number of concurrent streams per connection via server configuration (trade-off: reduces throughput for high-multiplexing clients); and configuring aggressive server-side timeouts to terminate stalled connections before buffers grow unbounded (trade-off: may affect slow-network legitimate clients and large file downloads). Additionally, rate-limiting new HTTP/2 connection establishment at the load balancer or firewall level can reduce the number of simultaneous stall attacks, though this does not eliminate the per-connection amplification risk.