# CVE-2019-0196: mod_http2 with scoreboard Use-After-Free (Read)

Crafted HTTP/2 request in mod_http2 references request data after its pool is destroyed, poisoning r->the_request via sprintf and causing UAF read.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: cy1337
- Disclosed: 2019-09-10
- CVE: CVE-2019-0196
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/527042
- Library page: https://bugbountylibrary.com/r/h1%3A527042
- Tags: area:cloud domain:infra impact:data-leak impact:dos kind:bounty platform:hackerone sev:medium technique:fuzzing vuln:dos vuln:info-disclosure vuln:memory-corruption

**Target:** mod_http2 scoreboard / request string handling
**Root cause:** mod_http2 accesses request data from a memory pool after that pool has been destroyed, then feeds the stale memory into an sprintf-style string construction.
**Steps:**
1. Build Apache httpd with ASAN enabled.
2. Send a crafted HTTP/2 request that causes the request pool to be destroyed while scoreboard data still references it.
3. Observe ASAN use-after-free report as stale memory is read into sprintf for r->the_request.
**How found:** Researcher built httpd with ASAN and crafted HTTP/2 requests to exercise scoreboard/request-pool lifetime, catching the UAF read in ASAN output.
**Insight:** HTTP/2 multiplexing and scoreboard updates can outlive per-request pools; fuzz request lifecycle transitions under ASAN to catch stale pool reads in string formatting paths.