Skip to main content

Apache HTTP Server CVE-2026-48913

| EUVDEUVD-2026-35101 HIGH
Use After Free (CWE-416)
2026-06-08 apache GHSA-fjj2-vrp3-84fv
Denial Of Service Apache Use After Free Memory Corruption Red Hat Apache Http Server Apache Software Foundation
7.3
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
7.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.3 MEDIUM
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

4
Analysis Generated
Jun 08, 2026 - 19:28 vuln.today
CVSS changed
Jun 08, 2026 - 19:22 NVD
7.3 (HIGH)
CVE Published
Jun 08, 2026 - 15:24 nvd
UNKNOWN (no severity yet)
CVE Published
Jun 08, 2026 - 15:24 nvd
HIGH 7.3

DescriptionCVE.org

Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted.

This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.

AnalysisAI

Use-after-free in the mod_http2 module of Apache HTTP Server versions 2.4.55 through 2.4.67 allows remote attackers to trigger memory corruption when the server's file handle pool is exhausted. The flaw carries a CVSS 7.3 (low impact across confidentiality, integrity, and availability) and is reachable over the network without authentication or user interaction, though no public exploit identified at time of analysis. Tagging emphasizes denial-of-service and memory corruption as the primary realistic outcomes.

Technical ContextAI

Apache HTTP Server's mod_http2 implements HTTP/2 multiplexing on top of the core httpd process model and manages per-stream resources tied to file descriptors. The root cause is CWE-416 (Use After Free): once file handles are already exhausted, an internal allocation/cleanup path in mod_http2 references memory that has already been freed, producing dangling-pointer use. The CPE cpe:2.3:a:apache_software_foundation:apache_http_server:*:*:*:*:*:*:*:* combined with the EUVD-confirmed range pins this to mainline 2.4.x deployments running HTTP/2 - typical of reverse proxies, TLS-terminating front-ends, and origin servers handling browser HTTP/2 traffic.

RemediationAI

No vendor-released patch identified at time of analysis from the supplied data; consult https://httpd.apache.org/security/vulnerabilities_24.html for the fixed 2.4.x release once published and upgrade beyond 2.4.67. As an interim compensating control, disable mod_http2 (comment out the LoadModule http2_module line and remove 'h2' / 'h2c' from Protocols), which forces clients to fall back to HTTP/1.1 and eliminates the vulnerable code path at the cost of losing HTTP/2 multiplexing and associated performance gains. Where HTTP/2 must remain, raise the operating-system file-descriptor limit for the httpd user (ulimit -n / LimitNOFILE) and tune MaxRequestWorkers / H2MaxSessionStreams downward so the descriptor pool is far less likely to exhaust, reducing the window in which the use-after-free is reachable; this mitigates but does not eliminate the bug. Front-ending httpd with a reverse proxy that terminates HTTP/2 (and forwards HTTP/1.1 to httpd) is another effective shield for exposed deployments.

More in Apache Http Server

View all
CVE-2026-23918 HIGH POC
8.8 May 04

Remote code execution via double-free memory corruption in Apache HTTP Server 2.4.66's HTTP/2 protocol implementation al
CVE-2026-34059 HIGH POC
7.5 May 04

Buffer over-read in Apache HTTP Server through 2.4.66 enables remote unauthenticated information disclosure at network s
CVE-2026-28780 CRITICAL
9.8 May 05

Remote heap buffer overflow in Apache HTTP Server's mod_proxy_ajp module allows complete system compromise when proxying
CVE-2026-29167 CRITICAL
9.8 Jun 08

Remote code execution in Apache HTTP Server versions 2.4.0 through 2.4.67 is possible through a use-after-free condition
CVE-2026-42535 CRITICAL
9.1 Jun 08

Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author
CVE-2026-24072 HIGH
8.8 May 04

Local .htaccess authors can escalate privileges to read arbitrary files as the httpd daemon user in Apache HTTP Server 2
CVE-2026-29169 HIGH
7.5 May 04

Remote attackers can crash Apache HTTP Server 2.4.66 and earlier by sending malicious requests that trigger a NULL point
CVE-2026-42536 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 allows remote unauthenticated attackers to crash the server
CVE-2026-34355 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server 2.4.0 through 2.4.67 stems from a heap buffer overflow in the mod_proxy_html out
CVE-2026-34356 HIGH
7.5 Jun 08

Denial of service in Apache HTTP Server versions 2.4.0 through 2.4.67 stems from a heap-based buffer overflow triggered

CVE-2026-29168 HIGH
7.3 May 05

Uncontrolled resource consumption in Apache HTTP Server's mod_md module allows remote unauthenticated attackers to exhau
CVE-2026-44185 HIGH
7.3 Jun 08

Buffer over-read in Apache HTTP Server 2.4.0 through 2.4.67 allows remote attackers to trigger memory disclosure or limi

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected

Share

CVE-2026-48913 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy