CVE-2026-23918: Apache HTTP Server 2.4.66 RCE via HTTP/2 Double-Free — Patch to 2.4.67 Now

Apache patched CVE-2026-23918 on May 4, 2026, shipping version 2.4.67 to address a CVSS 8.8 memory corruption flaw that can deliver unauthenticated remote code execution on popular Linux distributions and the official Docker image.

What it is. The vulnerability lives in mod_http2’s stream cleanup path — specifically in h2_mplx.c. It’s a classic CWE-415 double-free: when an HTTP/2 client sends a HEADERS frame immediately followed by a RST_STREAM frame with a non-zero error code before the stream has been registered by the multiplexer, the server frees the same memory region twice. The window for this race is reliably achievable with a single crafted request pair.

Who is affected. Apache HTTP Server 2.4.66 with mod_http2 loaded — which is enabled by default in most modern deployments. Only prefork MPM is unaffected (it doesn’t use the multiplexer code path). Worker and event MPM, which cover the overwhelming majority of production servers, are both vulnerable.

The RCE angle. On basic configurations the double-free produces a crash — a reliable denial of service but nothing more. The picture changes on Debian-derived systems and on the official Apache Docker image, which both use the Apache Portable Runtime’s mmap allocator. That allocator’s predictable memory layout means the freed chunk can be reclaimed and written to by a second request before the second free completes, giving an attacker a clean write-what-where primitive. Security researchers at striga.ai and isec.pl, who discovered the bug last December, confirmed a working proof-of-concept achieving RCE without authentication on Debian 12 + Apache 2.4.66 + Docker. No in-the-wild exploitation had been confirmed as of May 5, but that window will narrow fast.

Severity breakdown:

• CVSS 3.1 Base Score: 8.8 (High)
• Attack Vector: Network / No authentication required
• Impact: Confidentiality — High, Integrity — High, Availability — High
• Prefork MPM: DoS only (no RCE path)
• Worker/Event MPM on Debian or Docker: RCE

The fix is simple: upgrade to 2.4.67. Apache published the release on May 4 alongside two lower-severity patches. Most package managers have already pushed the update.

# Debian / Ubuntu
apt update && apt install apache2

# RHEL / CentOS / Fedora
dnf update httpd

# Docker — pull the latest official image
docker pull httpd:latest

After upgrading, verify with apache2 -v or httpd -v. If an immediate upgrade is impossible, disabling mod_http2 via a2dismod http2 (and restarting Apache) removes the vulnerable code path entirely, at the cost of HTTP/2 support.

The bug was reported by Bartlomiej Dmitruk of striga.ai and Stanislaw Strzalkowski of isec.pl. Apache’s full advisory and the 2.4.67 release notes are available at apache.org/security/vulnerabilities_24.html.

This is a straightforward patch-and-move-on situation when the patch is available. Any unpatched internet-facing Apache instance running worker or event MPM on Debian or Docker should be treated as a high-priority remediation today.