Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE

Apache HTTP Server 2.4.66 contains a critical double-free vulnerability in mod_http2 that enables both denial-of-service and remote code execution attacks.

• •CVE-2026-23918 occurs when HTTP/2 HEADERS frame is followed by RST_STREAM with a non-zero error code, causing the same h2_stream pointer to be cleaned up twice
• •DoS attack is trivial requiring only one TCP connection and two frames without authentication, causing worker process crashes
• •RCE exploitation is practical on systems with APR mmap allocator (default on Debian and official httpd Docker image), using fake h2_stream structures and scoreboard memory manipulation
• •Fixed in Apache HTTP Server version 2.4.67
• •Attack surface is large as mod_http2 ships in default builds and HTTP/2 is widely enabled in production