CVE-2026-23918HTTP Server Vulnerability
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.
Published May 4, 2026 · Updated Sep 23, 2026 · Also known as ALPINE-CVE-2026-23918, BIT-apache-2026-23918, DEBIAN-CVE-2026-23918, UBUNTU-CVE-2026-23918
Key Facts
Patch immediately- CVE-2026-23918 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting HTTP Server (Apache), Azl3 Httpd 2.4.66-1 (Microsoft), Cbl2 Httpd 2.4.66-1 (Microsoft) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 50% probability of exploitation in the next 30 days.
- Fixed versions are available, including apache 2.4.67, apache2 2.4.52-1ubuntu4.20, apache2 2.4.58-1ubuntu8.12.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
50%
Higher than 98.8% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
46/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
- advisoryhttps://www.cve.org/CVERecord?id=CVE-2026-23918
- advisoryhttps://security.alpinelinux.org/vuln/CVE-2026-23918
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2026-23918
- advisoryhttps://ubuntu.com/security/CVE-2026-23918
- advisoryRHSA-2026:13938
- advisoryhttps://httpd.apache.org/security/vulnerabilities_24.html
Description
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.
This issue affects Apache HTTP Server: 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Affected Products
167 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| HTTP ServerApache | 2.4.66, >= 2.4.66 | n/a |
| Azl3 Httpd 2.4.66-1Microsoft | See advisory | n/a |
| Cbl2 Httpd 2.4.66-1Microsoft | See advisory | n/a |
| apache2alpine | See advisory | 2.4.67-r0 |
| apachebitnami | >= 2.4.66 | 2.4.67 |
Patched Releases
apache
2.4.67
apache2
2.4.52-1ubuntu4.20, 2.4.58-1ubuntu8.12, 2.4.64-1ubuntu3.4, 2.4.66-1~deb13u2, 2.4.66-150400.6.57.1, 2.4.66-150600.5.52.1, 2.4.66-150700.4.20.1, 2.4.66-160000.2.1, 2.4.66-2ubuntu2.1, 2.4.66-5, 2.4.67-1.1, 2.4.67-1~deb12u2, 2.4.67-r0
apache2-bin
2.4.52-1ubuntu4.20, 2.4.58-1ubuntu8.12, 2.4.64-1ubuntu3.4, 2.4.66-2ubuntu2.1
apache2-data
2.4.52-1ubuntu4.20, 2.4.58-1ubuntu8.12, 2.4.64-1ubuntu3.4, 2.4.66-2ubuntu2.1
apache2-dev
2.4.52-1ubuntu4.20, 2.4.58-1ubuntu8.12, 2.4.64-1ubuntu3.4, 2.4.66-2ubuntu2.1
apache2-devel
2.4.66-150400.6.57.1, 2.4.66-150600.5.52.1, 2.4.66-150700.4.20.1, 2.4.66-160000.2.1
apache2-doc
2.4.52-1ubuntu4.20, 2.4.58-1ubuntu8.12, 2.4.64-1ubuntu3.4, 2.4.66-150400.6.57.1, 2.4.66-2ubuntu2.1
apache2-event
2.4.66-150700.4.20.1, 2.4.66-160000.2.1
apache2-manual
2.4.66-150600.5.52.1, 2.4.66-150700.4.20.1, 2.4.66-160000.2.1
apache2-prefork
2.4.66-150400.6.57.1, 2.4.66-150600.5.52.1, 2.4.66-150700.4.20.1, 2.4.66-160000.2.1
apache2-ssl-dev
2.4.52-1ubuntu4.20, 2.4.58-1ubuntu8.12, 2.4.64-1ubuntu3.4, 2.4.66-2ubuntu2.1
apache2-suexec-custom
2.4.52-1ubuntu4.20, 2.4.58-1ubuntu8.12, 2.4.64-1ubuntu3.4, 2.4.66-2ubuntu2.1
apache2-suexec-pristine
2.4.52-1ubuntu4.20, 2.4.58-1ubuntu8.12, 2.4.64-1ubuntu3.4, 2.4.66-2ubuntu2.1
apache2-utils
2.4.52-1ubuntu4.20, 2.4.58-1ubuntu8.12, 2.4.64-1ubuntu3.4, 2.4.66-150400.6.57.1, 2.4.66-150600.5.52.1, 2.4.66-150700.4.20.1, 2.4.66-160000.2.1, 2.4.66-2ubuntu2.1
apache2-worker
2.4.66-150400.6.57.1, 2.4.66-150600.5.52.1, 2.4.66-150700.4.20.1, 2.4.66-160000.2.1
httpd
2.4.67-1, 2.4.67-1.ph4, 2.4.67-1.ph5
httpd-devel
2.4.67-1.ph4, 2.4.67-1.ph5
httpd-docs
2.4.67-1.ph4, 2.4.67-1.ph5
httpd-main
2.4.67-0.1.hum1
httpd-tools
2.4.67-1.ph4, 2.4.67-1.ph5
libapache2-mod-md
2.4.52-1ubuntu4.20, 2.4.58-1ubuntu8.12
libapache2-mod-proxy-uwsgi
2.4.52-1ubuntu4.20, 2.4.58-1ubuntu8.12
mod_http2
2.0.39-1.amzn2023.0.1
rootio-apache2
2.4.66-1~deb13u2, 2.4.67-1~deb12u2
Timeline
Publicly disclosed
May 4, 2026
Last updated
Sep 23, 2026
Weakness Type
- CWE-415 Double Free
- CWE-1341 Multiple Releases of Same Resource or Handle
References
- advisorycve.org · CVERecord
- advisorysecurity.alpinelinux.org · CVE-2026-23918
- advisorysecurity-tracker.debian.org · CVE-2026-23918
- advisoryubuntu.com · CVE-2026-23918
- advisoryRHSA-2026:13938
FAQ
Common Questions.
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.
Affected: HTTP Server (Apache) versions 2.4.66, >= 2.4.66; Azl3 Httpd 2.4.66-1 (Microsoft); Cbl2 Httpd 2.4.66-1 (Microsoft), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including apache 2.4.67, apache2 2.4.52-1ubuntu4.20, apache2 2.4.58-1ubuntu8.12.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-23918 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo