Red Hat Security Advisory: mod_http2 security update

Fixed packages 1

Vulnerabilities 4

• High 7.5
  CVE-2025-53020 Public exploit

  Apache HTTP Server: HTTP/2 DoS by Memory Increase

  Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• High 7.5
  CVE-2026-49975 Public exploit EPSS 33%

  Apache HTTP Server: mod_http2 denial of service

  Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026
• High 7.3
  CVE-2026-48913

  Apache HTTP Server: mod_http2 memory corruption when file handles exhausted

  Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026
• Medium 6.5
  CVE-2026-43951

  Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash

  Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 8, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2379343
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2485371
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2486405
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2486415
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50572.json
• report
  https://access.redhat.com/security/cve/CVE-2025-53020
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-53020
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-53020
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2026-43951
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43951
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43951
• report
  https://access.redhat.com/security/cve/CVE-2026-48913
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-48913
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-48913
• report
  https://access.redhat.com/security/cve/CVE-2026-49975
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2026-007
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-49975
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-49975
• article
  https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb