CVE-2026-48913: Apache HTTP Server: mod_http2 memory corruption when file handles exhausted

Synopsis

A use-after-free vulnerability exists in the mod_http2 module of Apache HTTP Server versions 2.4.55 through 2.4.67. The flaw is reachable over the network without any authentication and is triggered when the server's file handles are exhausted, causing the module to operate on freed memory. Successful exploitation gives an attacker limited read access, limited write access, and can degrade service availability. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable mod_http2 endpoint is exposed over the network, so an attacker must be able to send HTTP/2 requests to the server to trigger the flaw.

• AuthenticationNot required

  No account or credential of any kind is needed; the vulnerability is reachable by unauthenticated HTTP/2 requests.

• Victim interactionNot required

  Exploitation is fully server-side; no user or administrator action is required to trigger the use-after-free condition.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond a file-handle-exhausted server state.

Blast Radius

• An attacker can read portions of server memory, which may include in-flight request data, headers, or session-related content.
• An attacker can write to freed memory regions, enabling limited corruption of server-side data structures or in-flight response content.
• The use-after-free condition can crash or destabilize the mod_http2 worker, causing HTTP/2 request handling to fail and degrading service availability for connected clients.
• Because all three impact dimensions (confidentiality, integrity, availability) are affected, a single exploit attempt can combine data leakage, content tampering, and service disruption.