Apache HTTP Server up to 2.4.67 mod_http2 memory corruption

Summaryinfo

A vulnerability, which was classified as critical, has been found in Apache HTTP Server up to 2.4.67. Impacted is an unknown function of the component mod_http2. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2026-48913. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Apache HTTP Server up to 2.4.67. This issue affects an unknown functionality of the component mod_http2. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.

The advisory is shared at lists.apache.org. The identification of this vulnerability is CVE-2026-48913. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 07/03/2026).

The vulnerability scanner Nessus provides a plugin with the ID 324047 (SUSE SLES15: apache2 / apache2-devel / apache2-doc / apache2-prefork / etc (SUSE-SU-2026:2686-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.4.68 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (324047) and EUVD (EUVD-2026-35101). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Web Server

Vendor

• Apache

Name

• HTTP Server

Version

• 2.4.0
• 2.4.1
• 2.4.2
• 2.4.3
• 2.4.4
• 2.4.5
• 2.4.6
• 2.4.7
• 2.4.8
• 2.4.9
• 2.4.10
• 2.4.11
• 2.4.12
• 2.4.13
• 2.4.14
• 2.4.15
• 2.4.16
• 2.4.17
• 2.4.18
• 2.4.19
• 2.4.20
• 2.4.21
• 2.4.22
• 2.4.23
• 2.4.24
• 2.4.25
• 2.4.26
• 2.4.27
• 2.4.28
• 2.4.29
• 2.4.30
• 2.4.31
• 2.4.32
• 2.4.33
• 2.4.34
• 2.4.35
• 2.4.36
• 2.4.37
• 2.4.38
• 2.4.39
• 2.4.40
• 2.4.41
• 2.4.42
• 2.4.43
• 2.4.44
• 2.4.45
• 2.4.46
• 2.4.47
• 2.4.48
• 2.4.49
• 2.4.50
• 2.4.51
• 2.4.52
• 2.4.53
• 2.4.54
• 2.4.55
• 2.4.56
• 2.4.57
• 2.4.58
• 2.4.59
• 2.4.60
• 2.4.61
• 2.4.62
• 2.4.63
• 2.4.64
• 2.4.65
• 2.4.66
• 2.4.67

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion