Apache fixes critical HTTP/2 vulnerability allowing remote code execution

As outlined in Security Affairs, Apache has released critical updates for its HTTP Server to address multiple vulnerabilities, including a severe flaw in its HTTP/2 protocol handler.

The vulnerability, identified as CVE-2026-23918 with a CVSS score of 8.8, is a double-free error within the HTTP/2 implementation. This flaw could allow an attacker to execute arbitrary code remotely on affected systems. Discovered by researchers Bartlomiej Dmitruk and Stanislaw Strzalkowski, the issue arises from a crafted HTTP/2 sequence that causes the same stream to be processed twice, leading to memory corruption.

The vulnerability impacts version 2.4.66 and is resolved in 2.4.67. Its exploitation could lead to denial of service or, in specific configurations like those using APR with mmap, remote code execution. A proof-of-concept exploit exists, and while the MPM prefork module is not affected, the widespread adoption of HTTP/2 increases the potential attack surface for this critical vulnerability.

Source: Security Affairs