Skip to content

Back to the catalog

Orca Security: Critical Apache HTTP Server HTTP/2 Vulnerability Could Enable Remote Code Execution
orca.securityadvisory

Orca Security: Critical Apache HTTP Server HTTP/2 Vulnerability Could Enable Remote Code Execution

Orca Security's write-up of CVE-2026-23918 (CVSS 8.8), a double-free memory corruption bug in Apache HTTP Server's mod_http2 stream cleanup logic. An unauthenticated attacker can trigger it by sending crafted HTTP/2 HEADERS frames followed by an early RST_STREAM with a non-zero error code. This causes heap corruption, crashes, and possibly remote code execution. Version 2.4.66 is affected and 2.4.67 fixes it. Public PoC details exist, but no in-the-wild exploitation had been reported. Disabling HTTP/2 is given as a temporary workaround.

TL;DR Double-free in Apache mod_http2 2.4.66 (CVE-2026-23918, CVSS 8.8) allows unauthenticated RCE or DoS via crafted HEADERS and RST_STREAM frames; fixed in 2.4.67.
Open original ↗

Organisations named here

  • double-free
  • RST_STREAM

CVEs named here

  • CVE-2026-23918

Technologies named here

  • Apache HTTP Server 2.4.66; fixed in 2.4.67
  • Apache HTTP Server
  • Orca
  • HTTP/2
  • mod_http2

Techniques named here

  • Denial of service via service crashes

Related in AppSec