Description
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.

This issue affects Apache HTTP Server: 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Published: 2026-05-04
Score: 8.8 High
EPSS: 49.7% Moderate
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is a double free in Apache HTTP Server’s HTTP/2 implementation that can trigger arbitrary code execution if exploited. It handling (CWE‑415) and an early reset scenario (CWE‑1341). An attacker could potentially execute malicious code on the host if the vulnerability is triggered during an HTTP/2 session.

Affected Systems

Apache HTTP Server version 2.4.66, released by the Apache Software Foundation, contains the susceptibility. Upgrading to version 2.4.67 (or later) removes the buggy code path and resolves the vulnerability.

Risk and Exploitability

The likely attack vector for this vulnerability is an HTTP/2 connection initiated from an external client. An attacker would need to trigger the bug through an early reset scenario within that protocol. Given a CVSS score of 8.8, the vulnerability is considered high severity, and the EPSS score of 50% indicates a fairly large likelihood of exploitation in the current threat landscape. The vulnerability is not listed in CISA’s KEV catalog. If successfully exploited, the double free could lead to arbitrary code execution on the affected server.

Generated by OpenCVE AI on July 27, 2026 at 04:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache HTTP Server to version 2.4.67 or later.
  • If an immediate upgrade is infeasible, disable HTTP/2 traffic from untrusted sources or enforce strict access controls on HTTP/2 connections.
  • Augment monitoring to detect crashes or abnormal memory behavior that could signal exploitation attempts.

Generated by OpenCVE AI on July 27, 2026 at 04:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6248-1 apache2 security update
Ubuntu USN Ubuntu USN USN-8239-1 Apache HTTP Server vulnerabilities
History

Wed, 06 May 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1341
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 04 May 2026 20:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apache:http_server:2.4.66:*:*:*:*:*:*:*

Mon, 04 May 2026 18:30:00 +0000

Type Values Removed Values Added
References

Mon, 04 May 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache http Server
Vendors & Products Apache
Apache http Server

Mon, 04 May 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 04 May 2026 15:00:00 +0000

Type Values Removed Values Added
Description Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Title Apache HTTP Server: http2: double free and possible RCE on early reset
Weaknesses CWE-415
References

Subscriptions

Apache Http Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-15T01:17:47.323Z

Reserved: 2026-01-19T13:00:21.720Z

Link: CVE-2026-23918

cve-icon Vulnrichment

Updated: 2026-05-04T17:32:35.852Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-04T15:16:03.583

Modified: 2026-06-17T10:22:17.787

Link: CVE-2026-23918

cve-icon Redhat

Severity : Important

Publid Date: 2026-05-04T14:44:28Z

Links: CVE-2026-23918 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-27T04:30:04Z

Weaknesses
  • CWE-1341

    Multiple Releases of Same Resource or Handle

  • CWE-415

    Double Free