https://bz.apache.org/bugzilla/show_bug.cgi?id=69904
Bug ID: 69904
Summary: Random crashes in apache 2.4.66 with mod_http2
Product: Apache httpd-2
Version: 2.4.66
Hardware: Other
OS: Linux
Status: NEW
Severity: critical
Priority: P2
Component: mod_http2
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Hello,
I am experiencing random crashes in apache 2.4.66. The issue occurs under real
traffic and appears linked to mod_http2 stream handling / APR pool destruction.
The crashes do not occur on apache 2.4.65, and downgrading or disabiling http/2
completely resolves the issue. The environment is RHEL 7 (but this also happens
on 8/9).
The worker processes crash under high load, causing aborted requests and slow
responses. Disabling H2Direct sometimes prevents crashes.
Log entries prior to crash:
++++++++++++++++++++++++++++
[Wed Dec 17 14:09:55.725579 2025] [core:notice] [pid 58687:tid 58687] AH00051:
child pid 58694 exit signal Segmentation fault (11), possible coredump in
/etc/apache2
[Wed Dec 17 14:09:55.746276 2025] [http2:info] [pid 59439:tid 59439]
h2_workers: created with min=60 max=90 idle_ms=600000
[Wed Dec 17 14:17:07.167591 2025] [core:notice] [pid 58687:tid 58687] AH00051:
child pid 58695 exit signal Bus error (7), possible coredump in /etc/apache2
++++++++++++++++++++++++++++
Sometimes the crash shows a free(): invalid pointer backtrace:
++++++++++++++++++++++++++++
[Mon Dec 15 15:28:03.415731 2025] [http2:info] [pid 128768:tid 128768]
h2_workers: created with min=60 max=90 idle_ms=600000
*** Error in `/usr/sbin/httpd': free(): invalid pointer: 0x000055ce33e47128 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x81329)[0x2ba115d49329]
/opt/cpanel/ea-apr16/lib64/libapr-1.so.0(apr_pool_destroy+0x1a7)[0x2ba11568ec97]
/etc/apache2/modules/mod_http2.so(+0x19964)[0x2ba11f83d964]
/etc/apache2/modules/mod_http2.so(+0x1a8c8)[0x2ba11f83e8c8]
/etc/apache2/modules/mod_http2.so(+0x2456c)[0x2ba11f84856c]
/etc/apache2/modules/mod_http2.so(+0xcccc)[0x2ba11f830ccc]
/etc/apache2/modules/mod_http2.so(+0xd177)[0x2ba11f831177]
/usr/sbin/httpd(ap_run_process_connection+0x40)[0x55ce32872250]
/etc/apache2/modules/mod_mpm_event.so(+0x742b)[0x2ba1164a542b]
/etc/apache2/modules/mod_mpm_event.so(+0xa94e)[0x2ba1164a894e]
/lib64/libpthread.so.0(+0x7ea5)[0x2ba1158afea5]
/lib64/libc.so.6(clone+0x6d)[0x2ba115dc6b3d]
++++++++++++++++++++++++++++
GDB Backtrace:
++++++++++++++++++++++++++++
#0 allocator_free (node=0xe3b0da2322830fb, allocator=0x2ae778007d80) at
memory/unix/apr_pools.c:443
#1 apr_pool_destroy (pool=0x2ae7780502e8) at memory/unix/apr_pools.c:1026
#2 0x00002ae71447e04c in h2_stream_destroy (stream=<optimized out>) at
h2_stream.c:635
#3 0x00002ae714471964 in c1_purge_streams (m=m@entry=0x2ae78c035f38) at
h2_mplx.c:625
#4 0x00002ae7144728c8 in h2_mplx_c1_poll (m=0x2ae78c035f38,
timeout=timeout@entry=0,
on_stream_input=on_stream_input@entry=0x2ae7144782f0 <on_stream_input>,
on_stream_output=on_stream_output@entry=0x2ae7144781a0 <on_stream_output>,
on_ctx=on_ctx@entry=0x2ae78c0358a0) at h2_mplx.c:659
#5 0x00002ae71447c56c in h2_session_process (session=0x2ae78c0358a0, async=1,
pkeepalive=pkeepalive@entry=0x2ae722b86ce4)
at h2_session.c:2013
#6 0x00002ae714464ccc in h2_c1_run (c=c@entry=0x2ae730023bd0) at h2_c1.c:132
#7 0x00002ae714465177 in h2_c1_hook_process_connection (c=0x2ae730023bd0) at
h2_c1.c:306
#8 0x000055fab793d250 in ?? ()
#9 0x00002ae730023b20 in ?? ()
#10 0x0000000000000011 in ?? ()
#11 0x000055fab91fccb8 in ?? ()
#12 0x00002ae70b0d942b in process_socket (thd=<optimized out>, p=<optimized
out>, sock=<optimized out>, cs=<optimized out>,
my_child_num=<optimized out>, my_thread_num=<optimized out>) at
event.c:1098
#13 0x00002ae70b0dc94e in worker_thread (thd=0x55fab91fccb8, dummy=<optimized
out>) at event.c:2252
#14 0x00002ae70a4e3ea5 in start_thread () from /lib64/libpthread.so.0
#15 0x00002ae70a9fab3d in clone () from /lib64/libc.so.6
++++++++++++++++++++++++++++
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
