CVSSv3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
From Developer Stefan Eissing:
The CVE-2026-23918 vulnerability was reported twice during that time by independent reporters. One developed an RCE which required an unguarded libc (which does not segfault, like the ones in the bug report), but also required knowledge about the server process address layout. Not impossible, but also not easily applied to any server out there.
From Discloser Bartłomiej Dmitruk:
Apache httpd 2.4.66 ships with mod_http2 compiled in. The module is not enabled by default in most Linux distribution packages, but it is widely enabled in production HTTP/2 deployments. Two HTTP/2 frames sent on the same stream, in a specific order, push the same
h2_streampointer onto an internal cleanup array twice. A later pass through that array callsapr_pool_destroyon already-freed memory. On default builds with the APR mmap allocator, the second freemunmaps pages that the process is about to dereference. One TCP connection and two frames are enough to crash a worker process. With a bit more work, the same primitive lands shellcode.
See his writeup for more details.
Other sources: