Skip to content
Apache HTTP/2 Double-Free Vulnerability CVE-2026-23918 Exploited for DoS

Apache HTTP/2 Double-Free Vulnerability CVE-2026-23918 Exploited for DoS

First seen 29 Oct 2026, 10:07 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 11:08 UTC
  • •CVE-2026-23918 affects Apache HTTP Server 2.4.66, leading to DoS through double-free vulnerability.
  • •The vulnerability is exploited by sending rapid RST_STREAM frames, causing worker crashes.
  • •Organizations should upgrade to Apache 2.4.67 or disable HTTP/2 to mitigate the risk.

CVE-2026-23918 is a double-free vulnerability in Apache HTTP Server 2.4.66's `mod_http2`, allowing attackers to cause denial of service (DoS) by sending rapid RST_STREAM frames. The flaw arises from a race condition in the cleanup process, leading to a SIGSEGV and worker crashes. The vulnerability was discovered by Bartłomiej Dmitruk and Stanisław Strzałkowski and affects systems running Apache 2.4.66, which was patched in version 2.4.67 released in May 2026. Proof-of-concept (PoC) exploits demonstrate reliable DoS attacks, with tools available for both rapid and sustained attacks. While remote code execution (RCE) is theoretically possible, it is not practical for most attackers. Organizations are advised to upgrade to version 2.4.67 or disable HTTP/2 to mitigate the risk. The vulnerability has been confirmed to crash servers within 30 seconds to 3 minutes under attack conditions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-05-01
Patch released for Apache 2.4.67
Apache released version 2.4.67, which includes a fix for the double-free vulnerability.
Sploitus
2026-05-04
CVE-2026-23918 published
CVE-2026-23918 was published, detailing a double-free vulnerability in Apache HTTP Server.
Sploitus
2026-05-05
First public PoC released
The first public proof-of-concept for CVE-2026-23918 was released, demonstrating the exploit.
Sploitus

More articles in this cluster (3)

Following this threat?

Track CVE-2026-23918 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 4

Common questions

Which versions of Apache are affected?
Apache HTTP Server 2.4.66 is affected by CVE-2026-23918; version 2.4.67 includes a fix.
How can organizations mitigate this vulnerability?
Organizations should upgrade to Apache 2.4.67 or disable HTTP/2 in their configurations.
Is remote code execution possible with this vulnerability?
While RCE is theoretically possible, it is not practical for most attackers, and the primary risk is denial of service.