CVE-2026-23918: apache software foundation apache http server Double Free
CVSS: 8.8v3.1HighModified
AliasesALPINE-CVE-2026-23918UBUNTU-CVE-2026-23918DEBIAN-CVE-2026-23918
Published 04-05-2026Last modified 15-07-2026
Vulnerability summary
CVE-2026-23918 is a high (CVSS 8.8) Double Free vulnerability in apache software foundation apache http server. EPSS estimates a 49.73% chance of exploitation in the next 30 days, higher than 98.8% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
49.73%
0%100%
High · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1exploit-database
Advisory lineage
Upstream 0 · Downstream 8 · Related 7Timeline
- 04-05-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
49.73%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 49.73% on 19-09-2026
19-09-202619-10-2026
EPSS score49.73%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundApache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- apache2< 2.4.67-r0
Apache1 product
- http_server2.4.66
Apache software foundation1 product
- apache http server2.4.66
Debian1 product
- apache2< 2.4.67-1~deb12u2 | < 2.4.66-1~deb13u2 | < 2.4.66-5
Ubuntu1 product
- apache2< 2.4.66-2ubuntu2.1
5 vendors · 5 products
References
12 links- httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
