CVE-2026-48913

HIGH

Apache HTTP Server: mod_http2 memory corruption when file handles exhausted

Title source: cna

Description

Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.

References (2)

Core 2

Core References

Vendor Advisory vendor-advisory

https://httpd.apache.org/security/vulnerabilities_24.html

Mailing List

http://www.openwall.com/lists/oss-security/2026/06/08/15

Scores

CVSS v3 7.3

EPSS 0.0048

EPSS Percentile 37.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-416

Status published

Products (2)

apache/http_server 2.4.55 - 2.4.68

Apache Software Foundation/Apache HTTP Server 2.4.55 - 2.4.67

Published Jun 08, 2026

Tracked Since Jun 08, 2026