CLEANSTART-2026-RR06957 When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2

🗓️ 09 Oct 2026 00:49:56Reported by GoogleType

osv-cleanstart🔗 osv.dev👁 4 Views

Apache HTTP Server handles destroyed HTTP/2 streams, leading to a security vulnerability.

Reporter	Title	Published	Views	Family All 89
ALT Linux	Security fix for the ALT Linux 8 package apache2 version 1:2.4.33-alt1	31 Mar 201800:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package apache2 version 1:2.4.33-alt1	31 Mar 201800:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package apache2 version 1:2.4.33-alt1	31 Mar 201800:00	–	altlinux
Amazon	Medium: httpd24	3 May 201800:00	–	amazon
Tenable Nessus	Amazon Linux AMI : httpd24 (ALAS-2018-1004)	4 May 201800:00	–	nessus
Tenable Nessus	Apache 2.4.x < 2.4.33 Multiple Vulnerabilities (deprecated)	30 Mar 201800:00	–	nessus
Tenable Nessus	Apache 2.4.x < 2.4.33 Multiple Vulnerabilities	8 Feb 201900:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: mod_http2 Multiple Vulnerabilities (ciqsa-2026_1605)	12 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 9.2 [CIQ] Security Update: mod_http2 / mod_http2-debuginfo / mod_http2-debugsource Multiple Vulnerabilities (ciqsa-2026_0459)	1 Oct 202600:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.6.0 : mod_http2 (EulerOS-SA-2020-2016)	29 Sep 202000:00	–	nessus

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-RR06957.json
osv	www.osv.dev/vulnerability/CVE-2018-1302
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-1302

09 Oct 2026 01:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 35.9

EPSS0.1288

Apache HTTP Server apache2 HTTP/2 security vulnerability