CVE-2019-10082: Apache HTTP Server

Critical severity, CVSS 9.1. EPSS: 16.5% chance of exploitation in the next 30 days.

In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.

Affected products

• Apache HTTP Server: from 2.4.18, up to and including 2.4.39
• Oracle Communications Element Manager: version 8.0.0 only; version 8.1.0 only; version 8.1.1 only; version 8.2.0 only
• Oracle Enterprise Manager Ops Center: version 12.3.3 only; version 12.4.0 only; version 12.4.0.0 only
• Oracle HTTP Server: version 12.2.1.3.0 only; version 12.2.1.4.0 only
• Oracle Instantis Enterprisetrack: from 17.1, up to and including 17.3
• Oracle Retail Xstore Point Of Service: version 7.1 only

Published 2019-09-26. Last modified 2026-06-17.