CVE-2026-23918 – High‑severity Double‑Free RCE in Apache httpd mod_http2

Key takeaways

• CVE-2026-23918 scores CVSS 8.8 (High).
• Double‑free in mod_http2 enables pre‑authentication RCE and trivial denial‑of‑service.
• Public PoC and exploit code are available; limited active exploitation has been reported.
• Affected: Apache HTTP Server 2.4.66 with mod_http2 enabled.
• Immediate patch to 2.4.67 or disable the module.

Overview

On 4 May 2026 the Apache Software Foundation released security advisory 2.4.67, fixing several critical issues in Apache HTTP Server. Among them is CVE-2026-23918, a double‑free memory bug in the HTTP/2 module (mod_http2) that can be triggered without authentication. The flaw allows an attacker to corrupt the server’s memory, leading to a denial‑of‑service (DoS) or remote code execution (RCE) on affected hosts.

Technical Details

The vulnerability is a classic double‑free (CWE‑415). In the HTTP/2 processing path, two nghttp2 callbacks are invoked for a single stream. Both callbacks push the same stream pointer onto the module’s cleanup array. When the request finishes, pool_destroy runs twice on the same pointer, freeing memory that is still referenced. By sending a crafted HTTP/2 sequence—HEADERS followed by a RST_STREAM frame with a non‑zero error code—an attacker can trigger the double‑free.

A working exploit re‑uses the freed memory via mmap and injects a fake cleanup structure into Apache’s scoreboard memory, achieving RCE on x86_64 systems. The exploit works against the default multi‑threaded MPMs (event/worker) in Apache 2.4.66.

Example of the malicious HTTP/2 frame sequence (simplified):

HEADERS
RST_STREAM (error_code != 0)

The PoC code is publicly available on GitHub (see References) and has been reproduced on multiple labs.

Severity & Impact

The CVSS vector reflects network‑accessible, low‑complexity, low‑privilege, no‑user‑interaction attacks with full confidentiality, integrity, and availability impact.

Affected Products

• Apache HTTP Server 2.4.66 with mod_http2 enabled (default in many distributions).
• The issue is limited to multi‑threaded MPMs (event/worker). The prefork MPM is not vulnerable.

For a complete list of affected versions and configurations, see the official CVE page: https://vulnsocial.com/cve/CVE-2026-23918.

What to Do Now

• Identify whether you run Apache 2.4.66 with mod_http2 enabled (apachectl -M | grep http2).
• Check your MPM type (apachectl -V); the bug only affects event/worker.
• Monitor access logs for unusual RST_STREAM frames with non‑zero error codes after HEADERS.
• Deploy the patch to Apache 2.4.67 or later immediately.
• If you cannot upgrade, disable the module: a2dismod http2 && systemctl restart apache2.
• Consider adding a WAF rule to drop malformed HTTP/2 frames that match the exploit pattern.
• Track real‑time threat intelligence on VulnSocial for new PoCs or exploit activity.

Remediation & Mitigation

1. Patch: Upgrade Apache HTTP Server to 2.4.67 (or newer) from the official Apache repository.
2. Restart the Apache service to load the updated binaries.
3. Verify the module version: apachectl -M | grep http2 should show the patched version.
4. If patching is not feasible, disable the module:

   a2dismod http2
   systemctl restart apache2
   

5. Network hardening: Block HTTP/2 RST_STREAM frames with non‑zero error codes using a reverse‑proxy or WAF.
6. Post‑patch validation: Run a vulnerability scanner or apachectl -t -D DUMP_MODULES to confirm the absence of the vulnerable module.

Bottom Line

CVE-2026-23918 is a high‑severity double‑free bug in Apache HTTP Server’s mod_http2 that enables pre‑authentication RCE and easy DoS. The vulnerability affects Apache 2.4.66 with multi‑threaded MPMs. Immediate patch to 2.4.67 or disabling the module is the only reliable mitigation. Keep an eye on exploit activity via VulnSocial.

References

• Apache Security Advisory – Vulnerabilities in 2.4.66/2.4.67: https://httpd.apache.org/security/vulnerabilities_24.html
• Openwall OSS‑Security mailing list discussion (2026‑05‑04): http://www.openwall.com/lists/oss-security/2026/05/04/19
• VulnSocial CVE page: https://vulnsocial.com/cve/CVE-2026-23918
• VulnSocial home: https://vulnsocial.com

#CVE #CVE202623918 #High #RCE #Apache #httpd #patch #security