CVE-2026-48913 — Apache HTTP Server: mod_http2 memory corruption when file handles exhausted

Description

Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted.

This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache HTTP Server	2.4.55 – ≤ 2.4.67	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	apache2	2.4.68-1	—
Debian 13	apache2	2.4.68-1~deb13u1	—
Debian 12	apache2	2.4.68-1~deb12u1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.04 LTS	apache2	2.4.66-2ubuntu2.4	USN-8516-1
Ubuntu 25.10	apache2	No fix yet	—
Ubuntu 24.04 LTS	apache2	2.4.58-1ubuntu8.15	USN-8516-1
Ubuntu 22.04 LTS	apache2	2.4.52-1ubuntu4.23	USN-8516-1

Show 4 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 20.04 LTS	apache2	2.4.41-4ubuntu3.23+esm5	USN-8571-1
Ubuntu Pro 18.04 LTS	apache2	2.4.29-1ubuntu4.27+esm10	USN-8571-1
Ubuntu Pro 16.04 LTS	apache2	2.4.18-2ubuntu3.17+esm19	USN-8571-1
Ubuntu Pro 14.04 LTS	apache2	2.4.7-1ubuntu4.22+esm14	USN-8571-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	mod_http2	2.0.29-4.el10_2.2	RHSA-2026:34355
RHEL 9	mod_http2	2.0.26-6.el9_8.2	RHSA-2026:59387

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 10.0 EUS	mod_http2	2.0.29-2.el10_0.2	RHSA-2026:50538
RHEL 9.6 EUS	mod_http2	2.0.26-4.el9_6.2	RHSA-2026:50572
RHEL 9.4 E4S	mod_http2	2.0.26-2.el9_4.3	RHSA-2026:55992
Red Hat JBoss Core Services 1	jbcs-httpd24-httpd +6	2.4.62-16.el8jbcs	RHSA-2026:56868
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_http2	2.0.29-13.el8jbcs	RHSA-2026:56868
Red Hat JBoss Core Services 1	jbcs-httpd24-mod_ssl +1	1:2.4.62-16.el8jbcs	RHSA-2026:56868
Red Hat Hardened Images 1	httpd +5	2.4.68-1.hum1	RHSA-2026:25042

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	mod_http2	2.0.29-4.el10_2.2	ALSA-2026:34355
AlmaLinux 9	mod_http2	2.0.26-6.el9_8.2	ALSA-2026:59387

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	mod_http2	2.0.29-4.el10_2.2	RLSA-2026:34355
Rocky Linux 9	mod_http2	2.0.26-6.el9_8.2	RLSA-2026:59387

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	apache2 +6	2.4.66-150700.4.23.1	SUSE-SU-2026:2759-1
SLES 15 SP6	apache2 +5	2.4.66-150600.5.55.1	SUSE-SU-2026:2735-1
SLES 15 SP5	apache2	2.4.66-150400.6.57.1	SUSE-SU-2026:2686-1
SLES 15 SP4	apache2	2.4.66-150400.6.57.1	SUSE-SU-2026:2686-1
SLES 12 SP5	apache2 +1	2.4.66-35.81.1	SUSE-SU-2026:2717-1

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 16.0	apache2 +6	2.4.66-160000.3.1	SUSE-SU-2026:22564-1
SLES for SAP 15 SP6	apache2 +5	2.4.66-150600.5.55.1	SUSE-SU-2026:2735-1
SLES for SAP 15 SP5	apache2	2.4.66-150400.6.57.1	SUSE-SU-2026:2686-1
SLES for SAP 15 SP4	apache2	2.4.66-150400.6.57.1	SUSE-SU-2026:2686-1
SLES 16.0	apache2 +6	2.4.66-160000.3.1	SUSE-SU-2026:22564-1
SLE HPC 15 SP5	apache2	2.4.66-150400.6.57.1	SUSE-SU-2026:2686-1
SLE HPC 15 SP4	apache2	2.4.66-150400.6.57.1	SUSE-SU-2026:2686-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	apache2	2.4.71-1.1	openSUSE-SU-2026:12537-1
openSUSE Leap 16.0	apache2 +6	2.4.66-160000.3.1	openSUSE-SU-2026:21235-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	apache2	2.4.68-r0	—
Alpine v3.23	apache2	2.4.68-r0	—
Alpine v3.22	apache2	2.4.68-r0	—
Alpine v3.21	apache2	2.4.68-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	mod_http2	2.0.42-1.amzn2023.0.1	ALAS2023-2026-1859

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	httpd	2.4.68-1	—
Azure Linux 3	mod_http2	No fix yet	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	mod_http2	2.0.29-4.el10_2.2	ELSA-2026-34355
Oracle Linux 9	mod_http2	2.0.26-6.el9_8.2	ELSA-2026-59387

Advisories 26

openSUSE-SU-2026:12537-1 apache2-2.4.71-1.1 on GA media SUSE / openSUSE Security Updates · Nov 14, 2026
WID-SEC-2026-2455 Oracle Solaris Drittanbieterkomponenten: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
WID-SEC-2026-1824 Apache HTTP Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
WID-SEC-2026-3595 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
ALSA-2026:59387 Moderate: mod_http2 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:34355 Moderate: mod_http2 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2026:56868 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP5 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RHSA-2026:59387 Red Hat Security Advisory: mod_http2 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RHSA-2026:55992 Red Hat Security Advisory: mod_http2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RHSA-2026:50538 Red Hat Security Advisory: mod_http2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RHSA-2026:50572 Red Hat Security Advisory: mod_http2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RHSA-2026:34355 Red Hat Security Advisory: mod_http2 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RHSA-2026:25042 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RLSA-2026:59387 Moderate: mod_http2 security, bug fix, and enhancement update Rocky Linux Security Advisories · Aug 26, 2026
ELSA-2026-59387 Moderate: mod_http2 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 25, 2026
USN-8571-1 apache2 vulnerabilities Ubuntu Security Notices (USN) · Jul 21, 2026
ELSA-2026-34355 Moderate: mod_http2 security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
SUSE-SU-2026:22564-1 Security update for apache2 SUSE / openSUSE Security Updates · Jul 15, 2026
openSUSE-SU-2026:21235-1 Security update for apache2 SUSE / openSUSE Security Updates · Jul 9, 2026
USN-8516-1 apache2 vulnerabilities Ubuntu Security Notices (USN) · Jul 8, 2026
RLSA-2026:34355 Moderate: mod_http2 security, bug fix, and enhancement update Rocky Linux Security Advisories · Jul 7, 2026
SUSE-SU-2026:2759-1 Security update for apache2 SUSE / openSUSE Security Updates · Jul 7, 2026
SUSE-SU-2026:2735-1 Security update for apache2 SUSE / openSUSE Security Updates · Jul 4, 2026
SUSE-SU-2026:2717-1 Security update for apache2 SUSE / openSUSE Security Updates · Jul 2, 2026
SUSE-SU-2026:2686-1 Security update for apache2 SUSE / openSUSE Security Updates · Jul 1, 2026
ALAS2023-2026-1859 Important: mod_http2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 22, 2026

References

https://httpd.apache.org/security/vulnerabilities_24.html vendor-advisory

EUVD	v3.1	7.3
CISA-ADP	v3.1	7.3