Skip to main content
IMMUNITYSEC

CVE-2026-23918

Apache HTTP Server: http2: double free and possible RCE on early reset

8.8
HIGH
CVSS 3.1
EPSS 49.7% · 99th pctCWE-415
2026-05-04Updated 2026-07-15

Description

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Severity

CVSS 3.1 · CISA8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC · CISA-ADP
Exploitationnone
Automatableno
Technical impacttotal

Exploitation Context

as of October 15, 2026
All KEV statistics→
  • Its current EPSS score (49.7%) is higher than that of 50% of CISA KEV entries.

Affected Products

ProductAffected versions
Apache Software Foundation
Apache HTTP Server
2.4.66

References

2 Links

Record Details

Published
2026-05-04
Last updated
2026-07-15
Assigner (CNA)
apache
Credited to
Bartlomiej Dmitruk, striga.ai; Stanislaw Strzalkowski, isec.pl

More from Apache

All Apache CVEs→
CVE-2021-4422810 CRITICAL

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Apache Software FoundationKEVEPSS 100.0%2021-12-10
CVE-2017-56389.8 CRITICAL

Apache Struts Remote Code Execution Vulnerability

Apache Software FoundationKEVEPSS 100.0%2017-03-11
CVE-2021-404389 CRITICAL

mod_proxy SSRF

Apache Software FoundationKEVEPSS 100.0%2021-09-16
CVE-2013-22519.8 CRITICAL

Apache Struts Improper Input Validation Vulnerability

KEVEPSS 100.0%2013-07-18

Related

Tool categories

FuzzingBinary Exploitation

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.