Quick answers
- Is CVE-2026-48913 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48913 being exploited in the wild.
- How severe is CVE-2026-48913?
- Informational severity, published 8 June 2026.
- Which products and versions are affected?
- Apache HTTP Server 2.4.55 through 2.4.67.
- Is there a fix for CVE-2026-48913?
- A patch was published on 2026-06-03: Fixed in 2.4.x by r1934882 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-48913 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-48913?
- Check whether you run Apache HTTP Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A use-after-free (CWE-416) vulnerability exists in the mod_http2 module of Apache HTTP Server. The flaw is triggered when the server attempts to handle HTTP/2 requests while the system's file handles are already exhausted. Under these specific resource-exhaustion conditions, the module may attempt to access memory that has already been freed, leading to memory corruption. An attacker could potentially exploit this to cause a denial-of-service (DoS) by crashing the server process. The issue is fixed in version 2.4.68.
Affected products
- Apache HTTP Server 2.4.55 through 2.4.67
Timeline
- 2026-05-22: disclosed: Reported to security team by Sam Lovejoy (IBM X-Force)
- 2026-06-03: patched: Fixed in 2.4.x by r1934882
- 2026-06-08: advisory: Update 2.4.68 released and CVE published