CVE-2026-23918
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 49.73%
- CWE
- CWE-415
- Published
- 2026-05-04
- Last modified
- 2026-07-15
Affected products
- Apache Software Foundation Apache HTTP Server
Weakness type
Related vulnerabilities
- CVE-2026-87585 — Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote...
- CVE-2026-61915 — An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An...
- CVE-2026-79907 — Acrobat Reader | Double Free (CWE-415)
- CVE-2026-81950 — Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-80080 — Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-69309 — Windows Print Spooler Components Elevation of Privilege Vulnerability
- CVE-2026-70567 — Windows Display Enhancement Service Elevation of Privilege Vulnerability
- CVE-2026-69725 — Windows Hello Elevation of Privilege Vulnerability