In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed,

Summary

In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.

Timeline

1. Sep 26, 2019, 2:40 PM UTCCVE published
2. Aug 4, 2024, 10:10 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a Apache HTTP Server

  2.4.18 to 2.4.39

References 16