Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE

Summary: Apache HTTP Server 2.4.66 carries CVE-2026-23918 (CVSS 8.8), a double-free in mod_http2's stream cleanup path in h2_mplx.c, fixed in version 2.4.67 and credited to Bartlomiej Dmitruk of Striga.ai and Stanislaw Strzalkowski of ISEC.pl. The bug triggers when a client sends an HTTP/2 HEADERS frame immediately followed by RST_STREAM with a non-zero error code before the multiplexer registers the stream, causing two nghttp2 callbacks to push the same h2_stream pointer onto the spurge cleanup array twice.
Bottom line: The denial-of-service takes one TCP connection and two frames with no authentication, and the researchers built a working x86_64 proof of concept for remote code execution that lands in minutes in lab conditions on the default mmap allocator used by Debian-derived systems and the official httpd Docker image.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-23918
Related: ⚡ Weekly Recap: Linux Rootkit, macOS Crypto Stealer, Web Socket Skimmers and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026