CVE-2026-23918
High · 8.8CVSS
8.8
EPSS
49.7%
Published
May 4, 2026
CISA due date
—
The record
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | apache2 | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-devel | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-event | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-manual | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-prefork | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-utils | 0 | 2.4.66-160000.2.1 |
| openSUSE:Leap 16.0 | apache2-worker | 0 | 2.4.66-160000.2.1 |
| openSUSE:Tumbleweed | apache2 | 0 | 2.4.67-1.1 |
Related vulnerabilities
- CVE-2026-28780 Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. Also affects apache2
- CVE-2026-29168 Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP… Also affects apache2
- CVE-2026-33007 A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and… Also affects apache2
- CVE-2026-33523 HTTP response splitting vulnerability in multiple Apache HTTP Server modules with… Also affects apache2
- CVE-2026-29169 A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may… Also affects apache2
- CVE-2026-33006 A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of… Also affects apache2
- CVE-2026-33857 Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. Also affects apache2
- CVE-2026-34032 Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. Also affects apache2