8.8 HighCWE-415
CVE-2026-23918
Apache Software Foundation Apache HTTP Server vulnerability
Apache Software FoundationApache HTTP Server
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
50%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
SeverityCVSS
8.8High
Description NVD
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Coverage 3 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 5 May · 11:42 UTC | SecurityWeek | Apache patches HTTP Server and MINA flaws, warns of RCE risk |
| Tue 5 May · 17:08 UTC | The Hacker News | Apache HTTP Server patches critical HTTP/2 flaw CVE-2026-23918 |
| Wed 6 May · 11:11 UTC | Security Affairs | Apache fixes HTTP/2 double‑free bug that could lead to RCE |
- Apache fixes HTTP/2 double‑free bug that could lead to RCESecurity Affairs
- Apache HTTP Server patches critical HTTP/2 flaw CVE-2026-23918The Hacker News
- Apache patches HTTP Server and MINA flaws, warns of RCE riskSecurityWeek · first in our coverage