CVE-2026-23918

HighCVSS 8.8

Published: 04/05/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

45.81%

99th percentile - higher than 99% of all known CVEs

Summary

A double free vulnerability in Apache HTTP Server when handling HTTP/2 protocol may lead to remote code execution (RCE). This issue affects version 2.4.66.

Risk Assessment

An attacker can remotely exploit this vulnerability to take control of the server, potentially leading to data breaches, service disruption, or further attacks on the infrastructure.

Recommendation

Immediately upgrade Apache HTTP Server to version 2.4.67, which fixes this vulnerability.

Original NVD description (English source)

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.