Moderate Vulnerability in mod_http2: HTTP/2 DoS by Memory Increase
Summary
ALSA-2026:22528: Moderate: mod_http2 security update. Affects mod_http2 versions < 2.0.29-4.el10_2. Fixed in 2.0.29-4.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mod_http2 package is an Apache HTTP Server module that enables the implementation of the HTTP/2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. This module enhances the performance of web applications by allowing multiple requests to be sent over a single connection, thus improving resource utilization and reducing latency. However, it is susceptible to vulnerabilities that can be exploited, leading to potential denial of service (DoS) attacks.
Vulnerability Detail
The vulnerability identified as CVE-2025-53020 allows an attacker to exploit the mod_http2 module, resulting in a denial of service condition due to excessive memory consumption. This can occur when an attacker sends specially crafted requests that cause the server to allocate more memory than it can handle, potentially leading to service outages or degraded performance. The issue arises from improper handling of HTTP/2 requests, making it critical for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
2.0.29-4.el10_2
This is the first release that contains the fix.
sudo dnf update mod_http2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the number of concurrent connections or implement rate limiting on their servers to mitigate the impact of potential DoS attacks until the package is updated. This can be configured in the Apache HTTP server settings.
Conclusion
The mod_http2 module is critical for enhancing web application performance but is currently vulnerable to a denial of service attack due to excessive memory usage. It is essential for users to update to the patched version to mitigate this risk. Additionally, temporary workarounds can be implemented to reduce the impact until the update is applied.
See every vulnerability recorded for mod_http2 →
FAQ
mod_http2 is an Apache HTTP Server module that implements the HTTP/2 protocol, allowing for improved performance and resource utilization in web applications.
CVE-2025-53020 refers to a specific vulnerability in the mod_http2 module that can lead to denial of service due to excessive memory consumption.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability may result in service outages or degraded performance due to potential denial of service attacks.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for mod_http2.
