mod_http2 in Apache 2.4.66 has a double-free bug inside h2_mplx.c:m_stream_cleanup(). The issue happens when a client sends a HEADERS frame immediately followed by a RST_STREAM on the same stream. If the timing is right, the stream ends up pushed twice into the m->spurge purge array. When the...