CVE-2026-23918

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Affected products

Apache Http Server, Linuxmint, Apple Macos, Red Os, Ubuntu

Apache Http Server

= 2.4.66

Fix

Available

CVSS 3.1

8.8 HIGH

EPSS

49.7% (99th percentile)

Weakness

CWE-415, CWE-1341

NVD status

Modified

Published

2026-05-04