CVE-2026-48913 is a Use After Free vulnerability (CWE-416) in the mod_http2 module of Apache HTTP Server. It occurs when file handles are already exhausted, potentially causing memory corruption. The affected versions are from 2.4.55 through 2.4.67 inclusive. The vulnerability has a CVSS 3.1 base score of 7.3, indicating a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information currently available to confirm remediation status.

Successful exploitation could allow an unauthenticated attacker to cause a Use After Free condition in the mod_http2 module, potentially leading to partial confidentiality, integrity, and availability loss of the affected server. The CVSS score reflects a high severity with network-based exploitation possible without privileges or user interaction.

Patch status is not yet confirmed — check the Apache Software Foundation advisory for current remediation guidance. Until an official fix is released, consider limiting exposure of the affected versions and monitoring for updates from the vendor.