Executive brief
Apache HTTP Server is a widely used web server for hosting websites and applications. A vulnerability in its HTTP/2 module could allow a remote attacker to cause memory corruption when the server runs out of available file handles. This could lead to service instability or a crash, potentially impacting website availability.
Technical details
A use-after-free (CWE-416) vulnerability exists in the mod_http2 module of Apache HTTP Server. The flaw is triggered when the server attempts to handle HTTP/2 requests while the system's file handles are already exhausted. Under these specific resource-exhaustion conditions, the module may attempt to access memory that has already been freed, leading to memory corruption. An attacker could potentially exploit this to cause a denial-of-service (DoS) by crashing the server process. The issue is fixed in version 2.4.68.
Affected products
- Apache HTTP Server 2.4.55 through 2.4.67
Timeline
- 2026-05-22: disclosed: Reported to security team by Sam Lovejoy (IBM X-Force)
- 2026-06-03: patched: Fixed in 2.4.x by r1934882
- 2026-06-08: advisory: Update 2.4.68 released and CVE published