CVE-2026-48913: Apache HTTP Server

High severity, CVSS 7.3. EPSS: 1.1% chance of exploitation in the next 30 days.

Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.

Affected products

• Apache HTTP Server: from 2.4.55, before 2.4.68 (fixed in 2.4.68)

Published 2026-06-08. Last modified 2026-07-23.