CVE-2026-23918: Apache HTTP Server HTTP/2 double free allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityNetwork-reachable double free with potential RCE and very high EPSS, though exploitation requires low privileges and no KEV listing or public exploit tag is present.

What it is

Apache HTTP Server 2.4.66 contains a double free in its HTTP/2 handling that can lead to remote code execution. The flaw is reachable over the network by an authenticated user without user interaction, and the vendor has released 2.4.67 as the fix.

Impact

An attacker can corrupt memory in the server process, potentially achieving remote code execution in the context of the httpd service and compromising confidentiality, integrity and availability.

Attack surface

Reached over the network via HTTP/2 requests to the affected server; the CVSS vector indicates low privileges are required (PR:L) and no user interaction (UI:N).

Exploitation

Not listed in CISA KEV and no public exploit reference is tagged, but EPSS is 0.49727 (98.84th percentile), indicating elevated predicted exploitation activity.

What to do

• Upgrade Apache HTTP Server to 2.4.67 or later, which the vendor states fixes the issue.
• Apply the Red Hat errata (RHSA-2026:13938) or equivalent distribution updates for packaged builds.
• If immediate upgrade is not possible, disable HTTP/2 (e.g., turn off mod_http2 / Protocols h2) until patched.
• Restrict HTTP/2 exposure to trusted clients and monitor for abnormal process crashes or restarts.
• Verify the running version after patching to confirm 2.4.66 is no longer in service.

Detection

• Monitor httpd logs and system logs for repeated crashes, segfaults or unexpected worker restarts that may indicate memory corruption attempts.
• Alert on HTTP/2 traffic from unusual or low-reputation sources, especially patterns of malformed or repeated stream activity.
• Track process-level crash dumps or core files generated by the httpd binary and correlate them with inbound HTTP/2 requests.
• Confirm asset inventory shows no remaining 2.4.66 instances exposed to untrusted networks.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.