Reported by 3 outlets

Timeline

1. original reporting

   Apache HTTP Server critical double-free RCE (CVE-2026-23918) — patch to 2.4.67 immediately

   cyberpress.org · 162d ago · May 5th, 2026

   The Apache Software Foundation has released version 2.4.67 to address a critical double-free memory corruption vulnerability in the HTTP/2 implementation of Apache HTTP Server 2.4.66. CVE-2026-23918 is triggered by a specially crafted "early reset" HTTP/2 frame that causes the server to free the same memory block twice, potentially enabling remote code execution. At minimum, exploitation causes denial-of-service via crash. The vulnerability was responsibly disclosed on December 10, 2025, but the patch took five months to reach public release. Given Apache's massive global deployment footprint, organizations should upgrade immediately or temporarily disable HTTP/2 as a mitigation.

2. update from

   Apache HTTP Server HTTP/2 double-free RCE (CVE-2026-23918) — CVSS 8.8, patch available

   · 153d ago · May 14th, 2026

   CISA-ADP scores it CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Given Apache's share of the web server market and the availability of the 2.4.67 patch since May 4, administrators who have not yet upgraded should do so immediately. [r/cybersecurity]

3. update from dlcdn.apache.org

   Apache HTTP Server 2.4.67 Fixes 11 Vulnerabilities Including HTTP/2 Double-Free RCE (CVE-2026-23918)

   dlcdn.apache.org · 145d ago · May 22nd, 2026

   Apache released version 2.4.67 addressing 11 security vulnerabilities. The most notable is CVE-2026-23918 (CVSS 8.8) — a double-free vulnerability in the HTTP/2 module allowing potential RCE triggered by early stream reset. Other fixes include CVE-2026-29168 (mod_md unrestricted OCSP response resource exhaustion), CVE-2026-28780 (heap buffer overflow in mod_proxy_ajp), and CVE-2026-24072 (mod_rewrite privilege escalation via ap_expr for .htaccess authors).

4. update from httpd.apache.org

   Apache HTTP Server CVE-2026-23918 — Pre-Auth Double-Free in mod_http2 Enables DoS and RCE (CVSS 8.8) — PoC Published

   httpd.apache.org · 139d ago · May 28th, 2026

   A critical double-free memory corruption vulnerability in Apache HTTP Server's mod_http2 module (CVE-2026-23918, CVSS 8.8) affects version 2.4.66 running multi-threaded MPM (event/worker) configurations — the default for most deployments. The attack requires only one TCP connection and two HTTP/2 frames: a HEADERS frame immediately followed by RST_STREAM on the same stream before the multiplexer registers it. Two nghttp2 callbacks push the same pointer onto a cleanup array twice; when freed, the second free operates on already-freed memory. On all deployments, exploitation guarantees denial of service — crashing worker processes with zero authentication. On Debian-derived systems (including Ubuntu, Kali, and the official Apache Docker image), where APR uses the mmap allocator, independent researchers at Striga.ai and ISEC.pl have confirmed a working remote code execution chain. The exploit leverages Apache's scoreboard — a shared-memory region mapped at a fixed address even with ASLR enabled — as a stable container to place fake structs, then tricks the cleanup path into calling system() with attacker-controlled arguments. No complete interim mitigation exists short of disabling HTTP/2 (Protocols h2 h2c). MPM prefork configurations are not affected. The PoC is available at striga-ai/CVE-2026-23918.

5. mentioned by

   Apache HTTP Server CVE-2026-23918 — Pre-auth double-free in mod_http2, CVSS 8.8, PoC published. See 🔴 Critical Threats section above. [[Apache Advisory](https://httpd.apache.org/security/vulnerabilities_24.html); ProbablyPwned; Lyrie Research; r/cybersecurity]

   · 139d ago · May 28th, 2026