Double Free and Possible RCE in Apache HTTP Server

Publication date: 2026-05-04

Last updated on: 2026-06-30

Assigner: Apache Software Foundation

Description

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-04

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-05-05

EPSS Evaluated

2026-07-05

NVD

CVE-2026-23918

Affected Vendors & Products

Vendor	Product	Version / Range
apache	http_server	2.4.66

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-415	The product calls free() twice on the same memory address.
CWE-1341	The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.

Attack-Flow Graph

Executive Summary

This vulnerability is a Double Free and possible Remote Code Execution (RCE) issue in the Apache HTTP Server when using the HTTP/2 protocol. A double free occurs when a program attempts to free the same memory location twice, which can lead to memory corruption and potentially allow an attacker to execute arbitrary code remotely.

Impact Analysis

This vulnerability can have severe impacts including allowing an attacker to execute arbitrary code on the affected server remotely. This can lead to full compromise of the server, data breaches, service disruption, and unauthorized access to sensitive information.

Mitigation Strategies

Users are recommended to upgrade Apache HTTP Server from version 2.4.66 to version 2.4.67, which fixes the double free and possible remote code execution vulnerability.

Hi! I’m here to help you understand CVE-2026-23918. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70