Red Hat Security Advisory

RHSA-2026:50538

mod_http2 security update

Released 2026-08-05 · Red Hat rating Important · View on Red Hat →

Fixed in

TI-2026-36808 CVE-2026-49975 · GHSA-262v-g5h9-6mc6

HIGH 72

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.3295 Published 2026-06-08 Fixed CWE-789

TI-2025-33022 CVE-2025-53020 · GHSA-c2vf-6g7v-8m6c

MEDIUM 47

Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04963 Published 2025-07-10 Fixed CWE-401

TI-2026-36173 CVE-2026-48913 · GHSA-fjj2-vrp3-84fv

LOW 39

Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00479 Published 2026-06-08 Partial fix CWE-416

TI-2026-32006 CVE-2026-43951 · GHSA-4qxr-h6g3-8f95

LOW 36

Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00545 Published 2026-06-08 Partial fix CWE-125