Vulnerability intelligence

CVE-2026-23918

Apache Software Foundation Apache HTTP Server CWE-415

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

CVSS Score

8.8

High

EPSS — Exploit Probability

50%

Riskier than 99% of all CVEs · checked 2026-09-07

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

3 articles across 3 outlets · first covered May 5, 2026 · latest May 6, 2026

Coverage timeline

Apache fixes HTTP/2 double‑free bug that could lead to RCE
securityaffairs.com · May 6, 2026
Apache HTTP Server patches critical HTTP/2 flaw CVE-2026-23918
thehackernews.com · May 5, 2026
Apache patches HTTP Server and MINA flaws, warns of RCE risk
www.securityweek.com · May 5, 2026

Related CVEs — Apache Software Foundation

CVE-2026-80180 CVE-2026-80181 CVE-2026-81270 CVE-2026-80190 CVE-2026-50112 CVE-2026-63038 CVE-2026-63043 CVE-2026-63044