diff --git a/mod_http2-2.0.9-CVE-2026-49975.patch b/mod_http2-2.0.9-CVE-2026-49975.patch
new file mode 100644
index 0000000000000000000000000000000000000000..bfd9b23e2f56f35090bc63fc284f9942dc6b7fd4
--- /dev/null
+++ b/mod_http2-2.0.9-CVE-2026-49975.patch
@@ -0,0 +1,39 @@
+From 35c6e405390ed361189a82acd96675401ea5947c Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <icing@users.noreply.github.com>
+Date: Wed, 27 May 2026 11:27:30 +0200
+Subject: [PATCH] cookie reqest header counting (#324)
+
+* cookie reqest header counting
+
+Account merged cookie headers as an "add" to keep LimitRequestFields effective.
+
+* ignore duplicate empty cookie headers
+
+Adapted-by: PkgAgent (modified to adapt to opencloudos-stream; upstream req_add_header signature vs h2_req_add_header)
+---
+ mod_http2/h2_util.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/mod_http2/h2_util.c b/mod_http2/h2_util.c
+index f40bce1..d1e56ab 100644
+--- a/mod_http2/h2_util.c
++++ b/mod_http2/h2_util.c
+@@ -1682,6 +1682,8 @@ apr_status_t h2_req_add_header(apr_table_t *headers, apr_pool_t *pool,
+         if (existing) {
+             char *nval;
+ 
++            if (!vlen)
++                return APR_SUCCESS;
+             /* Cookie header come separately in HTTP/2, but need
+              * to be merged by "; " (instead of default ", ")
+              */
+@@ -1692,6 +1694,8 @@ apr_status_t h2_req_add_header(apr_table_t *headers, apr_pool_t *pool,
+             hvalue = apr_pstrndup(pool, value, vlen);
+             nval = apr_psprintf(pool, "%s; %s", existing, hvalue);
+             apr_table_setn(headers, "Cookie", nval);
++            /* Treat the merge as an "add" to not escape LimitRequestFields */
++            *pwas_added = 1;
+             return APR_SUCCESS;
+         }
+     }
+
diff --git a/mod_http2.spec b/mod_http2.spec
index 7553fd723401a8635c017375847d26a267229def..96a95463f56445addf43950ffc8aec2fb0fb2813 100644
--- a/mod_http2.spec
+++ b/mod_http2.spec
@@ -3,10 +3,11 @@
 Summary:        HTTP/2 module for Apache httpd
 Name:           mod_http2
 Version:        2.0.9
-Release:        7%{?dist}
+Release:        8%{?dist}
 License:        ASL 2.0
 URL:            https://icing.github.io/mod_h2/
 Source0:        https://github.com/icing/mod_h2/releases/download/v%{version}/mod_http2-%{version}.tar.gz
+Patch0001:      mod_http2-2.0.9-CVE-2026-49975.patch
 
 BuildRequires:  make gcc pkgconfig autoconf libtool
 BuildRequires:  httpd-devel libnghttp2-devel openssl-devel /usr/bin/hostname
@@ -17,7 +18,7 @@ This module provides HTTP/2 (RFC 7540) support for the Apache HTTP Server.
 It relies on libnghttp2 to provide the core http/2 engine.
 
 %prep
-%autosetup
+%autosetup -p1
 
 %build
 autoreconf -i
@@ -41,6 +42,10 @@ echo "LoadModule proxy_http2_module modules/mod_proxy_http2.so" > %{buildroot}%{
 %{_httpd_moddir}/mod_proxy_http2.so
 
 %changelog
+* Wed Aug 05 2026 PkgAgent Robot <pkgagent@opencloudos.tech> - 2.0.9-8
+- [Type] security
+- [DESC] Fix CVE-2026-49975: account merged cookie headers as add to keep LimitRequestFields effective and ignore duplicate empty cookie headers
+
 * Thu Sep 26 2024 OpenCloudOS Release Engineering <releng@opencloudos.tech> - 2.0.9-7
 - Rebuilt for clarifying the packages requirement in BaseOS and AppStream