# mod_http2, read-after-free in h2 connection shutdown (CVE-2019-10082)

Race in mod_http2 shutdown lets nghttp2 reference a stream after mod_http2 frees it, causing heap use-after-free read in worker threads.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: cy1337
- Disclosed: 2019-10-15
- CVE: CVE-2019-10082
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/680415
- Library page: https://bugbountylibrary.com/r/h1%3A680415
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:medium tech:linux technique:fuzzing technique:race-window vuln:dos vuln:memory-corruption vuln:race-condition

**Target:** Apache httpd mod_http2 (HTTP/2 session handling)
**Root cause:** During connection shutdown, nghttp2 retains a reference to a stream that mod_http2 has already destroyed via h2_stream_destroy, so h2_stream_send_frame reads freed memory.
**Steps:**
1. Build httpd 2.4.39 with ASAN and set `MaxMemFree 1`
2. Run http2fuzz (https://github.com/c0nrad/http2fuzz) against the server
3. Fuzzed HTTP/2 input triggers stream teardown racing with nghttp2 frame send during shutdown
4. ASAN reports heap-use-after-free READ in h2_stream_send_frame at h2_stream.c:377
**How found:** Fuzzed network input against an ASAN build of httpd with MaxMemFree 1 to surface memory-safety crashes in HTTP/2 session handling.
**Exploitation:** Remote unauthenticated attacker sends crafted HTTP/2 traffic to trigger the race during connection shutdown, causing memory faults in worker threads and denial of service; potential for code execution or info leak not investigated.
**Insight:** Setting MaxMemFree 1 forces pool frees immediately, exposing lifetime bugs where a library (nghttp2) holds references to objects owned by the host (mod_http2) across shutdown; fuzz with aggressive allocator settings to surface such races.