redhat/mod_http2 vulnerabilities

Latest redhat/mod_http2 CVEs

Newest publication first

1. CVE-2026-119618 Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

   Published 2026-11-11

   Critical·CVSS 9.8 EPSS 0.40%

   Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 thr...

2. CVE-2026-57941 Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

   Published 2026-10-01

   Critical·CVSS 9.8 EPSS 0.59%

   Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

3. CVE-2026-49975 Apache HTTP Server: mod_http2 denial of service

   Published 2026-06-08

   High·CVSS 7.5 EPSS 33.0%

   Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

4. CVE-2026-48913 Apache HTTP Server: mod_http2 memory corruption when file handles exhausted

   Published 2026-06-08

   High·CVSS 7.3 EPSS 0.48%

   Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.

5. CVE-2026-43951 Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash

   Published 2026-06-08

   Medium·CVSS 6.5 EPSS 0.55%

   Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

6. CVE-2026-23918 Apache HTTP Server: http2: double free and possible RCE on early reset

   Published 2026-05-04

   High·CVSS 8.8 EPSS 49.7%

   Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.