The Apache Software Foundation (ASF) has released security updates to address vulnerabilities in the HTTP Server, including a serious vulnerability that could potentially lead to remote code execution (RCE).
The vulnerability, tracked as CVE-2026-23918 (CVSS score: 8.8), has been described as a “double free and possible RCE” in the handling of the HTTP/2 protocol. This issue affects Apache HTTP Server 2.4.66 and has been fixed in version 2.4.67.
Striga.ai co-founder Bartlomiej Dmitruk and ISEC.pl researcher Stanislaw Strzalkowski discovered and responsibly reported the vulnerability in question.
See also: MetInfo CMS vulnerability exploited for RCE attacks
Dmitruk told The Hacker News that CVE-2026-23918 is a critical vulnerability, as it can be exploited to achieve denial-of-service (DoS) and remote code execution (RCE). As mentioned above, the vulnerability is a double-free case in Apache httpd 2.4.66 mod_http2, specifically in the stream cleanup path of h2_mplx.c. The flaw is triggered when a client sends an HTTP/2 HEADERS frame immediately after an RST_STREAM with a non-zero error code on the same stream, before the multiplexer has recorded the stream.
Two nghttp2 callbacks are then triggered, on_frame_recv_cb for RST and on_stream_close_cb for close. Both end up calling h2_mplx_c1_client_rst -> m_stream_cleanup, which adds the same h2_stream pointer to the spurge cleanup array twice. When c1_purge_streams later repeats the spurge and calls h2_stream_destroy -> apr_pool_destroy on each entry, the second call hits memory that has already been freed.
Apache HTTP/2: How do we get to DoS and RCE?
Dmitruk added that a DoS attack is simple and works on any default deployment with mod_http2 and multi-threaded MPM, while the RCE path requires an Apache Portable Runtime (APR) with the mmap allocator, which is the default on Debian-derived systems and in the official httpd Docker image.
See also: AI found 20-year-old bugs in PostgreSQL and MariaDB
Dmitruk explained how a denial-of-service attack: one TCP connection, two frames, no authentication, no special headers and no specific URL, and the worker crashes. Apache restarts it, but every request to the crashed worker is rejected, and the pattern can be maintained as long as the attacker keeps sending.
The second effect is remote code execution. A fake h2_stream struct at the freed virtual address points to the freed virtual address in system() and uses Apache's scoreboard memory as a stable container for the fake structs and the command. The scoreboard is at a fixed address for the lifetime of the server, even with ASLR, which makes the RCE path practical. The usual caveats apply: practical exploitation requires leaking information about system() and scoreboard offsets.
Dmitruk also noted that the MPM prefork is not affected by the bug. However, the researcher warned that the attack surface is large since mod_http2 is included in default builds and HTTP/2 is widely enabled in production deployments.
Due to the severity of the bug, users are advised to apply the latest patches for optimal protection.
See also: WhatsApp reveals file spoofing and URL scheme vulnerabilities
In conclusion, the CVE-2026-23918 vulnerability highlights once again how critical it is to continuously monitor and promptly apply security updates to key infrastructure such as the Apache HTTP Server. Although its exploitation for full remote code execution requires specific conditions, the ability to cause denial-of-service attacks in a relatively simple way makes the problem particularly serious for organizations that rely on HTTP/2 deployments. The widespread use of Apache in production environments significantly increases the potential impact of the vulnerability.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The Apache Software Foundation's timely response with the release of version 2.4.67 highlights the importance of collaboration between the security community and software developers. For system administrators, immediate upgrades are the only way to go, while regular server configuration checks and proactive security practices are essential. In an ever-evolving cyberthreat landscape, prevention and speed of response remain the most effective means of protection.
