The vulnerability is a use‑after‑free in the mod_http2 module that occurs when the server has already exhausted its file handles. The resulting memory corruption can allow an attacker to manipulate internal data structures, potentially leading to arbitrary code execution or denial of service.

The flaw is present in Apache HTTP Server versions 2.4.55 through 2.4.67, all available from the Apache Software Foundation.

The exploit requires the attacker to force the server into a state where file handles are fully consumed, and then send crafted HTTP/2 traffic that triggers the use‑after‑free. While the EPSS score is unavailable and the vulnerability is not listed in CISA KEV, the lack of a public exploit combined with the potential for remote code execution suggests a high risk. The CVSS score is 7.3, indicating a high severity, but the memory corruption indicates a serious threat if mitigated quickly.