The vulnerability, tracked as CVE-2026-23918, has been described as a case of 'double free and possible RCE' in the HTTP/2 protocol handling.
| Vendor | Product | Versions |
|---|---|---|
| apache | http_server | 2.4.66, 2.4.67 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| apache | http | cert_advisory | 90% |
Updated description with CVE-2026-23918, marked exploit as available, noted it is actively exploited, and indicated no patch version number provided.
Updated description with new technical details, marked the vulnerability as CRITICAL, and noted that it is actively exploited.
Initial creation
