Description
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.

This issue affects Apache HTTP Server: 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Published: 2026-05-04
Score: 8.8 High
EPSS: 45.8% Moderate
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a double free in the HTTP/2 implementation of Apache HTTP Server, which can lead to arbitrary code execution. The flaw involves improper memory deallocation identified by CWE-415 and CWE-1341, and the CVE description notes that exploitation could result in remote code execution. The available information does not specify exact conditions for exploitation, but the potential impact includes full compromise of the affected system.

Affected Systems

The flaw affects the Apache HTTP Server 2.4.66 version provided by the Apache Software Foundation. Upgrading to 2.4.67 removes the vulnerability.

Risk and Exploitability

With a CVSS score of 8.8, the vulnerability is high severity. The EPSS score of 46% indicates a substantial likelihood that the flaw will be actively exploited in the wild. The likely attack vector is via an HTTP/2 connection initiated by an external client, as the flaw resides in the HTTP/2 implementation. The vulnerability is not listed in the CISA KEV catalog, but the combination of a high severity rating and a relatively high probability score suggests a need for prompt remediation.

Generated by OpenCVE AI on June 30, 2026 at 16:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache HTTP Server to version 2.4.67 or later.
  • If upgrade is delayed, monitor the server for crashes or abnormal behavior that may indicate exploitation.
  • Consult the Apache Software Foundation’s security advisories to stay informed of new patches or mitigations.

Generated by OpenCVE AI on June 30, 2026 at 16:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6248-1 apache2 security update
Ubuntu USN Ubuntu USN USN-8239-1 Apache HTTP Server vulnerabilities
History

Wed, 06 May 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1341
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 04 May 2026 20:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apache:http_server:2.4.66:*:*:*:*:*:*:*

Mon, 04 May 2026 18:30:00 +0000

Type Values Removed Values Added
References

Mon, 04 May 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache http Server
Vendors & Products Apache
Apache http Server

Mon, 04 May 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 04 May 2026 15:00:00 +0000

Type Values Removed Values Added
Description Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Title Apache HTTP Server: http2: double free and possible RCE on early reset
Weaknesses CWE-415
References

Subscriptions

Apache Http Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-06-30T03:20:08.368Z

Reserved: 2026-01-19T13:00:21.720Z

Link: CVE-2026-23918

cve-icon Vulnrichment

Updated: 2026-05-04T17:32:35.852Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-04T15:16:03.583

Modified: 2026-06-17T10:22:17.787

Link: CVE-2026-23918

cve-icon Redhat

Severity : Important

Publid Date: 2026-05-04T14:44:28Z

Links: CVE-2026-23918 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-30T16:45:04Z

Weaknesses
  • CWE-1341

    Multiple Releases of Same Resource or Handle

  • CWE-415

    Double Free