Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2026-23918 EUVD-2026-26955GHSA-p8fm-9c82-pw4g

Apache HTTP Server: http2: double free and possible RCE on early reset

Published May 4, 2026 · Updated Jul 15, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache HTTP Server Package: apache2 Package: apache2 Package: apache2 Package: httpd Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.

This issue affects Apache HTTP Server: 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache HTTP Server 2.4.66 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 apache2 2.4.66-5 —
Debian 13 apache2 2.4.66-1~deb13u2 —
Debian 12 apache2 2.4.67-1~deb12u2 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS apache2 2.4.66-2ubuntu2.1 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 httpd +5 2.4.67-0.1.hum1 RHSA-2026:13938

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 apache2 2.4.66-150400.6.57.1 SUSE-SU-2026:2686-1
SLES 15 SP4 apache2 2.4.66-150400.6.57.1 SUSE-SU-2026:2686-1
SLES 12 SP5 apache2 +1 2.4.66-35.78.1 SUSE-SU-2026:2641-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 apache2 +6 2.4.66-160000.2.1 SUSE-SU-2026:22209-1, SUSE-SU-2026:22199-1
SLES for SAP 15 SP5 apache2 2.4.66-150400.6.57.1 SUSE-SU-2026:2686-1
SLES for SAP 15 SP4 apache2 2.4.66-150400.6.57.1 SUSE-SU-2026:2686-1
SLES 16.0 apache2 +6 2.4.66-160000.2.1 SUSE-SU-2026:22209-1, SUSE-SU-2026:22199-1
SLE HPC 15 SP5 apache2 2.4.66-150400.6.57.1 SUSE-SU-2026:2686-1
SLE HPC 15 SP4 apache2 2.4.66-150400.6.57.1 SUSE-SU-2026:2686-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed apache2 2.4.67-1.1 openSUSE-SU-2026:10785-1
openSUSE Leap 16.0 apache2 +6 2.4.66-160000.2.1 openSUSE-SU-2026:21115-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 apache2 2.4.67-r0 —
Alpine v3.23 apache2 2.4.67-r0 —
Alpine v3.22 apache2 2.4.67-r0 —
Alpine v3.21 apache2 2.4.67-r0 —
Alpine v3.20 apache2 2.4.67-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 mod_http2 2.0.39-1.amzn2023.0.1 ALAS2023-2026-1724

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 httpd 2.4.67-1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 15 repositories · most starred shown

  • striga-ai/CVE-2026-23918 ★ 32 · May 11, 2026

    Double-free in Apache httpd mod_http2 stream cleanup leading to pre-auth RCE.

  • xeloxa/CVE-2026-23918-Apache-H2-PoC ★ 23 · May 6, 2026

    Proof-of-Concept exploit for CVE-2026-23918 (Apache mod_http2 double-free). Features multi-mode DoS (Rapid-RST, Slow-Drip) and passive RCE/vulnerability detection for Apache 2.4.66.

  • rhasan-com/CVE-2026-23918 ★ 8 · May 6, 2026

    Apache HTTP/2 double-free vulnerability PoC (CVE-2026-23918)

  • qassam-315/CVE-2026-23918-Elite-Auditor ★ 6 · May 5, 2026

    Elite reconnaissance script for auditing Apache's HTTP/2 stack against memory corruption (CVE-2026-23918). Features ALPN protocol forcing and monochrome dashboard intelligence. Built for Blue Teams a…

  • 12lie20/CVE-2026-23918-test ★ 4 · May 5, 2026

    This repository contains a Proof of Concept (PoC) demonstrating the Double Free vulnerability (CVE-2026-23918) in Apache HTTP Server 2.4.66 `mod_http2`.

  • alt3kx/CVE-2026-23918 ★ 1 · May 7, 2026

    CVE-2026-23918 Apache mod_http2 Double-Free Detector

  • hackervlogofficial/CVE-2026-23918 ★ 1 · May 6, 2026

    This is a proactive tool for security auditing. For your GitHub repository, you’ll want a description that highlights its safety (non-intrusive) and its specific utility for system administrators.

  • seguridadentrerios/CVE-2026-23918 ★ 0 · May 6, 2026
  • aa022/CVE-2026-23918-Passive-Audit ★ 0 · May 5, 2026

    Passive HTTP metadata auditor for CVE-2026-23918 exposure triage

  • rshosting/Apache-CVE-2026-23918-fix ★ 0 · May 5, 2026

    Upgrade to Apache 2.4.67 to fix CVE-2026-23918 vulneribility

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 12

References