CVE-2026-57941

A flaw was found in the mod_http2 module of Apache HTTP Server. A remote, unauthenticated attacker could exploit a use-after-free condition—where memory is accessed after being released—through re-entrant processing of shared session buffers. This flaw can allow an attacker to potentially execute arbitrary code or crash the server, resulting in a Denial of Service (DoS).

A use-after-free flaw was found in mod_http2, the HTTP/2 module for the Apache HTTP Server. A remote attacker with no privileges can trigger re-entrant use of a shared per-session buffer (session->bbtmp) while the server is handling HTTP/2 traffic. That interleaving is not a single reliable request, and the demonstrated effect is a crash of the httpd worker, which is a denial of service. A further memory-corruption outcome has not been shown.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable mod_http2 until a fixed package is installed. In /etc/httpd/conf.modules.d/10-h2.conf, comment out the module and restart the service:

#LoadModule http2_module modules/mod_http2.so

$ systemctl restart httpd