CVE-2019-10082: Use After Free
A read-after-free vulnerability was discovered in Apache httpd, in modhttp2. A specially crafted http/2 client session could cause the server to read memory that was previously freed during connection shutdown, potentially leading to a crash.
Other sources
A vulnerability was found in httpd, where using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.
— Red Hat
In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Information
Mitigation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-10082?
CVE-2019-10082 is a read-after-free vulnerability in Apache httpd, in mod_http2, which could result in a crash.
What is the severity of CVE-2019-10082?
The severity of CVE-2019-10082 is medium with a CVSS score of 6.5.
Which software versions are affected by CVE-2019-10082?
The Apache HTTP Server versions 2.4.18-2.4.39 are affected by CVE-2019-10082.
How can I fix CVE-2019-10082?
To fix CVE-2019-10082, you should update your Apache HTTP Server to version 2.4.41 or higher.
Where can I find more information about CVE-2019-10082?
You can find more information about CVE-2019-10082 on the Red Hat Bugzilla page.