CVE-2019-10082

A read-after-free vulnerability was discovered in Apache httpd, in mod_http2. A specially crafted http/2 client session could cause the server to read memory that was previously freed during connection shutdown, potentially leading to a crash.

Mitigation

This flaw is only exploitable if Apache httpd is configured to respond to HTTP/2 requests, which is done by including "h2" or "h2c" in the "Protocols" list in a configuration file. The following command can be used to search for possible vulnerable configurations:

grep -R '^\s*Protocols\>.*\<h2\>' /etc/httpd/  

See <https://httpd.apache.org/docs/2.4/mod/mod_http2.html&gt;