The vulnerability exists in the way Apache's mod_http2 handles stream cleanup during rapid connection resets. A logic flaw allows the cleanup routine to be called twice for the same stream object. Because the pointer to the memory pool is not nullified after the first destruction, the second call attempts to destroy an already freed pool, leading to a double-free condition. In certain memory configurations, this can be leveraged for Remote Code Execution (RCE) by grooming the heap to place attacker-controlled data in the freed memory slot.
void h2_stream_cleanup(h2_stream *stream) {
  if (stream->pool) {
    apr_pool_destroy(stream->pool);
    stream->pool = NULL; // Missing in vulnerable versions
  }
  // ... later in the same execution path ...
  if (stream->pool) {
    apr_pool_destroy(stream->pool); // Double Free occurs here
  }
}
The fix involves ensuring that the stream's memory pool pointer is explicitly set to NULL immediately after the first destruction call, and adding state checks to prevent re-entry into the cleanup logic for a single stream.