RHSA-2026:55992: Important: mod_http2 security update
Important: modhttp2 security update
Other sources
The modh2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.Security Fix(es): modhttp2: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020) httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) httpd: modhttp2: Apache HTTP Server modhttp2: Use After Free vulnerability allows arbitrary code execution or denial of service. (CVE-2026-48913) httpd: Apache HTTP Server: Out-of-bounds Read in modheaders and modmime (CVE-2026-43951) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
httpd: Apache HTTP Server (mod_headers and mod_mime)to a version that resolves this vulnerability.Patch CVE-2026-43951 - Upgrade
Upgrade
httpd: Apache HTTP Server (HTTP/2 DoS via compression bomb and Slowloris-style attack)to a version that resolves this vulnerability.Patch CVE-2026-49975 - Upgrade
Upgrade
httpd: Apache HTTP Server (mod_http2)to a version that resolves this vulnerability.Patch CVE-2026-48913 - Upgrade
Upgrade
mod_http2 Apache httpd moduleto a version that resolves this vulnerability.Patch CVE-2025-53020
Event History
Frequently Asked Questions
Which Red Hat Enterprise Linux platforms and service offerings are covered?
The advisory lists Red Hat Enterprise Linux offerings for x86_64, ARM 64, IBM z Systems, and Power LE. Covered service categories include Extended Life Cycle, four years of updates, AUS, and Update Services for SAP Solutions.
Does the update address impacts beyond HTTP/2 denial of service?
The fixes address remote denial-of-service conditions affecting HTTP/2, including memory increase and compression-bomb/Slowloris-style attacks. They also address a use-after-free issue that can allow arbitrary code execution or denial of service, plus an out-of-bounds read in mod_headers and mod_mime.