Use After Free Vulnerability in Apache HTTP Server mod_http2
CVE-2026-48913

7.3HIGH

Key Information:

Vendor

Apache
Status
Apache Http Server
Vendor
CVE Published:
8 June 2026

What is CVE-2026-48913?

A Use After Free vulnerability exists in the mod_http2 module of the Apache HTTP Server. This issue occurs when file handles become exhausted, potentially allowing attackers to exploit the system. Such vulnerabilities can lead to memory corruption and unexpected behavior, compromising the integrity and availability of affected systems. Users of Apache HTTP Server versions from 2.4.55 to 2.4.67 are encouraged to review and apply the appropriate security patches to mitigate risks.

Affected Version(s)

Apache HTTP Server 2.4.55 <= 2.4.67

References

https://httpd.apache.org/security/vulnerabilities_24.html
vendor-advisory

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sam Lovejoy, IBM X-Force Offensive Research (XOR)
.