CVE-2026-23918: Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects

This week

HIGH 8.8WATCHLISTDOWNGRADE

CVE-2026-23918 is a high-severity flaw (CVSS 8.8) affecting http server. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Why this priority

High severity
EPSS top 1%: very likely to be exploited
Public exploit reference
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	8.8 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	49.7% (top 1%)
CISA exploited list	No
Weakness	CWE-415, CWE-1341
Published	2026-05-04
Last modified	2026-10-26

Publisher (CNA): Apache Software Foundation · Vendor: apache

Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-05-04 15:16 UTCPublished CVE record published
2026-10-26 19:10 UTCUpdated Record last modified

apache http server DOWNGRADE

Affected: 2.4.66

Fixed in: no fixed release known

Safe to downgrade to: a release before 2.4.66

1. Check installed version

apt-cache policy http-server || rpm -q http-server || http-server --version

2. No fixed release: DOWNGRADE to a release before 2.4.66 (Debian / Ubuntu)

apt-cache madison http-server sudo apt install http-server=<VERSION_BEFORE_2.4.66> sudo apt-mark hold http-server

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list http-server sudo dnf downgrade http-server-<VERSION_BEFORE_2.4.66> sudo dnf versionlock add http-server

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.

Fedora 46 · ddnet · FIXED · 20.2-1.fc46 · FEDORA-2026-6991b4ab14 · source

sudo dnf upgrade --advisory=FEDORA-2026-6991b4ab14

Fedora ELN · libplacebo · FIXED · 7.360.1-5.eln159 · FEDORA-2026-92226f221e · source

sudo dnf upgrade --advisory=FEDORA-2026-92226f221e

Debian 12 · apache2 · FIXED · 2.4.67-1~deb12u2

sudo apt update && sudo apt install --only-upgrade apache2 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' apache2)" ge "2.4.67-1~deb12u2" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · apache2 · FIXED · 2.4.66-1~deb13u2

sudo apt update && sudo apt install --only-upgrade apache2 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' apache2)" ge "2.4.66-1~deb13u2" && echo PATCHED || echo STILL-VULNERABLE

RHEL 10 · httpd · NOT AFFECTED

RHEL 10 · mod_http2 · NOT AFFECTED

RHEL 6 · httpd · NOT AFFECTED

RHEL 7 · httpd · NOT AFFECTED

RHEL 8 · httpd:2.4/httpd · NOT AFFECTED

Alpine 3.20 · apache2 · FIXED · apache2-2.4.67-r0

apk add --upgrade apache2 apk info -v apache2

Alpine 3.21 · apache2 · FIXED · apache2-2.4.67-r0

apk add --upgrade apache2 apk info -v apache2

Alpine 3.22 · apache2 · FIXED · apache2-2.4.67-r0

apk add --upgrade apache2 apk info -v apache2

Alpine 3.23 · apache2 · FIXED · apache2-2.4.67-r0

apk add --upgrade apache2 apk info -v apache2

Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2026-1724 · source

sudo dnf update --advisory=ALAS2023-2026-1724

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: striga-ai/CVE-2026-23918 (32 stars)
GitHub PoC: xeloxa/CVE-2026-23918-Apache-H2-PoC (23 stars)
GitHub PoC: rhasan-com/CVE-2026-23918 (8 stars)
Exploit-DB: Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service

Advisories and coverage

Research and news

Zero Day Initiative Blog: The July 2026 Apple Security Update Review 2026-07-30

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-23918?

http server: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2026-23918 being exploited?

CVE-2026-23918 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-23918 affect?

CVE-2026-23918 affects http server. Severity is high (CVSS 8.8). Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

How urgent is CVE-2026-23918?

Priority 66/100. High severity; EPSS top 1%: very likely to be exploited; Public exploit reference; On your watchlist

Software pages

Apache HTTP Server vulnerabilities

Related CVEs

CVE-2026-34291 HIGH 8.7 DOWNGRADE Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-24072 HIGH 8.8 UPGRADE An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess aut
CVE-2026-34059 HIGH 7.5 UPGRADE Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66.
CVE-2026-33523 MEDIUM 6.5 UPGRADE HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised bac
CVE-2026-34032 MEDIUM 5.3 UPGRADE Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache

References

← Back to latest CVEs