CVE-2026-23918: Apache HTTP Server

High severity, CVSS 8.8. EPSS: 49.7% chance of exploitation in the next 30 days.

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Affected products

• Apache HTTP Server: version 2.4.66 only

Published 2026-05-04. Last modified 2026-07-15.