The Apache Software Foundation has released security updates for Apache HTTP Server 2.4.67 to fix a critical HTTP/2 flaw tracked as CVE-2026-23918, which carries a CVSS score of 8.8 and could lead to denial-of-service or remote code execution.
KEY FACTS
- Vulnerability The bug is a double free in HTTP/2 handling in Apache httpd 2.4.66.
- Impact It can crash workers and, in some setups, be used for code execution.
- Fix Apache HTTP Server 2.4.67 addresses the issue.
- Researchers Bartlomiej Dmitruk and Stanislaw Strzalkowski were credited with reporting it.
In a security advisory from the Apache HTTP Server project, the flaw is described as a double free in the mod_http2 stream cleanup path. It can be triggered when a client sends an HTTP/2 HEADERS frame followed immediately by an RST_STREAM frame with a non-zero error code before the multiplexer registers the stream.
The report says the denial-of-service outcome is straightforward on default deployments that use mod_http2 and a multi-threaded MPM. A remote code execution path is also described for systems using the APR mmap allocator, which is the default on Debian-derived systems and the official httpd Docker image.
Dmitruk said the issue could be exploited with one TCP connection and two frames to crash a worker. The disclosure also says a proof of concept achieved code execution on x86_64 in lab conditions, although practical exploitation would still require an information leak and reliable heap reuse.
Apache said the prefork MPM is not affected. The attack surface remains broad because mod_http2 is included in default builds and HTTP/2 is widely enabled in production.
WHY IT MATTERS
Operators running Apache HTTP Server 2.4.66 with HTTP/2 enabled should update quickly, since the flaw can disrupt service and may expose some environments to remote code execution. The advisory indicates that systems using the fixed release are protected from the issue.