CVE-2026-48913

A flaw was found in the Apache HTTP Server's mod_http2 module. This vulnerability, known as a Use After Free, occurs when the server's file handles are exhausted. An attacker could potentially exploit this to cause a denial of service or, in some cases, execute arbitrary code, leading to system compromise.

A use-after-free vulnerability exists in the Apache HTTP Server mod_http2 module when system file handles are exhausted. A remote attacker could trigger this flaw via HTTP/2 requests to cause a denial of service (crash) or memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the mod_http2 module if HTTP/2 protocol support is not required. This can be achieved by commenting out or removing the LoadModule http2_module modules/mod_http2.so line in the Apache HTTP Server configuration file (e.g., /etc/httpd/conf.modules.d/00-base.conf or similar).

After modifying the configuration, the httpd service must be restarted for the changes to take effect. This action may impact services relying on HTTP/2.