Apache fixes critical HTTP/2 double-free flaw CVE-2026

CVE-2026-23918 is a double-free memory-corruption flaw (CWE-415) in the HTTP/2 protocol handling of Apache HTTP Server, which per the advisory can lead to possible remote code execution. It is triggered remotely over an HTTP/2 connection to an affected server; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable, low-privilege access with no user interaction required. A successful attacker can corrupt the heap of the httpd process, with potential for remote code execution and high impact on confidentiality, integrity, and availability. Only Apache HTTP Server 2.4.66 is listed as affected, and the fix is shipped in 2.4.67; distributions such as Debian (whose 13.5 point release landed with security fixes) are already distributing patched packages. No public proof-of-concept or confirmed in-the-wild exploitation is known and it is not yet in CISA KEV, but EPSS assigns a ~50% probability of exploitation within 30 days (99th percentile), so defenders should treat it as likely to be exploited soon.

Do: Upgrade to Apache HTTP Server 2.4.67, and verify the effective patched package version on your systems since distributions may ship the fix backported under their own package versions. If you cannot upgrade promptly, disable the HTTP/2 protocol (h2, mod_http2) on internet-facing virtual hosts or restrict client access to them. Maintain heightened monitoring, as the ~50% EPSS probability of exploitation within 30 days suggests active exploitation may begin even without a public PoC yet.