Executive brief
A vulnerability exists in the Apache HTTP Server's handling of the HTTP/2 protocol. If exploited, this could allow an attacker to crash the web server or potentially execute malicious code, leading to a full system compromise or service outage. Organizations using the affected version should update immediately to maintain the integrity and availability of their web services.
Technical details
A double free vulnerability (CWE-415) exists in the mod_http2 component of Apache HTTP Server version 2.4.66. The flaw is triggered during an 'early reset' of an HTTP/2 stream, which can lead to memory corruption. A remote attacker with network access can exploit this to cause a denial-of-service (crash) or potentially achieve remote code execution (RCE). The issue is resolved in version 2.4.67.
Affected products
- Apache HTTP Server 2.4.66
Timeline
- 2025-12-10: other: Reported in PR 69899
- 2026-05-04: disclosed: Public disclosure via oss-security mailing list
- 2026-05-04: patched: Version 2.4.67 released with fix
References
- https://httpd.apache.org/security/vulnerabilities_24.html
- http://www.openwall.com/lists/oss-security/2026/05/04/19
- https://access.redhat.com/errata/RHSA-2026:13938
- https://access.redhat.com/security/cve/CVE-2026-23918
- https://bugzilla.redhat.com/show_bug.cgi?id=2465304
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23918.json