CVE-2026-23918CWE-415

Apache HTTP Server: http2: double free and possible RCE on early reset

High · published May 4, 2026

CVSS v3.1
8.8
EPSS
50%
Percentile
98.9
In the wild
Unconfirmed
What it is

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.

This issue affects Apache HTTP Server: 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.49727 · 98.9th percentile
Weakness
CWE-415 · Double Free
Published
2026-05-04T14:44Z
EPSS history
Timeline
  • 04 MAY 14:44Z
    Apache HTTP Server: http2: double free and possible RCE on early reset
    cvelistv5