CVE-2019-0196

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.17 through 2.4.38

Description A vulnerability was discovered in the Apache HTTP Server, specifically in the mod http2 module, related to the use of freed memory. This issue could allow a remote attacker to cause a denial of service or access sensitive information by sending a specially crafted request. The vulnerability is triggered by using fuzzed network input, which can cause the http/2 request handling to access freed memory during string comparison when determining the method of a request, leading to incorrect request processing.

Recommendations For Apache HTTP Server versions 2.4.17 through 2.4.38, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling the http/2 protocol until a patch is available. Restrict access to the mod http2 module to minimize the risk of exploitation.