Red Hat Security Advisory: mod_http2 security, bug fix, and enhancement update
Two moderate severity vulnerabilities were identified in the Apache HTTP Server mod_http2 module used in Red Hat Enterprise Linux 9 and 10. CVE-2026-48913 is a use-after-free vulnerability that could allow arbitrary code execution or denial of service. CVE-2026-43951 is an out-of-bounds read vulnerability in mod_headers and mod_mime. Red Hat has released patches addressing these issues in updated mod_http2 packages for affected RHEL versions.
AI Analysis
Technical Summary
The mod_http2 Apache httpd module, which implements the HTTP/2 protocol on top of libnghttp2 for httpd 2.4 servers, contains two security flaws. CVE-2026-48913 is a Use After Free vulnerability that may lead to arbitrary code execution or denial of service. CVE-2026-43951 is an Out-of-bounds Read vulnerability affecting mod_headers and mod_mime. Red Hat has issued security advisories RHSA-2026:34355 and RHSA-2026:59387 providing patches for these vulnerabilities in Red Hat Enterprise Linux versions 9 and 10. The advisories include updated mod_http2 packages that fix these issues.
Potential Impact
Successful exploitation of CVE-2026-48913 could allow an attacker to execute arbitrary code or cause a denial of service on affected systems. CVE-2026-43951 could lead to information disclosure or application instability due to out-of-bounds memory reads. Both vulnerabilities affect the mod_http2 module in Apache HTTP Server on Red Hat Enterprise Linux 9 and 10, potentially impacting web server security and stability.
Mitigation Recommendations
Red Hat has released official patches for these vulnerabilities in updated mod_http2 packages for Red Hat Enterprise Linux 9 and 10. Users should apply the updates as detailed in Red Hat advisories RHSA-2026:34355 and RHSA-2026:59387 to remediate these issues. No additional mitigation steps are indicated beyond applying the vendor-provided fixes.
Red Hat Security Advisory: mod_http2 security, bug fix, and enhancement update
Description
Two moderate severity vulnerabilities were identified in the Apache HTTP Server mod_http2 module used in Red Hat Enterprise Linux 9 and 10. CVE-2026-48913 is a use-after-free vulnerability that could allow arbitrary code execution or denial of service. CVE-2026-43951 is an out-of-bounds read vulnerability in mod_headers and mod_mime. Red Hat has released patches addressing these issues in updated mod_http2 packages for affected RHEL versions.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The mod_http2 Apache httpd module, which implements the HTTP/2 protocol on top of libnghttp2 for httpd 2.4 servers, contains two security flaws. CVE-2026-48913 is a Use After Free vulnerability that may lead to arbitrary code execution or denial of service. CVE-2026-43951 is an Out-of-bounds Read vulnerability affecting mod_headers and mod_mime. Red Hat has issued security advisories RHSA-2026:34355 and RHSA-2026:59387 providing patches for these vulnerabilities in Red Hat Enterprise Linux versions 9 and 10. The advisories include updated mod_http2 packages that fix these issues.
Potential Impact
Successful exploitation of CVE-2026-48913 could allow an attacker to execute arbitrary code or cause a denial of service on affected systems. CVE-2026-43951 could lead to information disclosure or application instability due to out-of-bounds memory reads. Both vulnerabilities affect the mod_http2 module in Apache HTTP Server on Red Hat Enterprise Linux 9 and 10, potentially impacting web server security and stability.
Mitigation Recommendations
Red Hat has released official patches for these vulnerabilities in updated mod_http2 packages for Red Hat Enterprise Linux 9 and 10. Users should apply the updates as detailed in Red Hat advisories RHSA-2026:34355 and RHSA-2026:59387 to remediate these issues. No additional mitigation steps are indicated beyond applying the vendor-provided fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:34355
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-48913"]
- State
- PUBLISHED
Threat ID: 6a46ed0327e9c79719445203
Added to database: 07/02/2026, 22:58:11 UTC
Last enriched: 09/10/2026, 14:24:13 UTC
Last updated: 10/01/2026, 14:51:06 UTC
Views: 174
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.