Critical Security Update for mod_http2: Addressing Use After Free and Out-of-Bounds Read Vulnerabilities
Summary
ALSA-2026:34355: Moderate: mod_http2 security, bug fix, and enhancement update. Affects mod_http2 versions < 2.0.29-4.el10_2.2. Fixed in 2.0.29-4.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mod_http2 is an Apache HTTP Server module that implements the HTTP/2 protocol, enhancing web performance and efficiency. It relies on libnghttp2 to provide support for HTTP/2 features. However, vulnerabilities have been identified in this module, specifically a Use After Free vulnerability and an Out-of-Bounds Read issue, which could lead to severe security risks.
Vulnerability Detail
The vulnerabilities in mod_http2 stem from improper memory management and input validation. The Use After Free vulnerability (CVE-2026-48913) allows attackers to execute arbitrary code or cause a denial of service by exploiting freed memory. Additionally, the Out-of-Bounds Read vulnerability (CVE-2026-43951) can lead to information disclosure or application crashes due to improper handling of input data. Both vulnerabilities pose significant risks to server integrity and user data security.
How To Fix
Minimum fixed version
2.0.29-4.el10_2.2
This is the first release that contains the fix.
sudo dnf update mod_http2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the mod_http2 module until the package can be updated. This can be done by executing the command: 'sudo a2dismod http2'. However, this may impact the performance of HTTP/2 enabled sites.
Conclusion
The vulnerabilities identified in mod_http2 pose serious security risks that can lead to arbitrary code execution and denial of service. It is crucial to update the package to the latest version to mitigate these risks. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for mod_http2 →
FAQ
mod_http2 is an Apache module that enables support for the HTTP/2 protocol, improving web performance and resource utilization.
The Use After Free vulnerability can lead to arbitrary code execution, allowing attackers to take control of the server or cause a denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider disabling the mod_http2 module as a temporary workaround to mitigate risks.
For detailed information, refer to the CVE pages for CVE-2026-43951 and CVE-2026-48913, which provide insights into the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for mod_http2.
