Red Hat Security Advisory: mod_http2 security, bug fix, and enhancement update

Fixed packages 3

Vulnerabilities 2

• High 7.3
  CVE-2026-48913

  Apache HTTP Server: mod_http2 memory corruption when file handles exhausted

  Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026
• Medium 6.5
  CVE-2026-43951

  Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash

  Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2486405
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2486415
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34355.json
• report
  https://access.redhat.com/security/cve/CVE-2026-43951
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43951
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43951
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2026-48913
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-48913
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-48913