CVE detail
CVE-2026-23918
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 27.7 · diversity 20.0 · KEV 0.0 · OTX 0.0 · PoC 4.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
15 source links · newest first
- Debian 13.5 point release lands with security fixes, bug patchesHelp Net Security
Debian 13.5 is the fifth point release for the stable distribution “trixie.” The update folds in roughly 100 Debian Security Advisories and corrections for more than 130 source packages, covering everything from the Linux kernel and Apache HTTP Server to OpenSSH, sudo, systemd, OpenSSL, glibc, and FreeRDP. Fresh installer images carrying the same fixes will follow at the regular download locations. Sysadmins running trixie do not need to reinstall. Existing media remain valid, and machines … More →
newswww.helpnetsecurity.comMay 17, 2026, 10:03 PM A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Quasar Linux RAT (QLNX): A Fileless Linux Implant Built for Stealth and Persistence Braintrust security incident […]
newssecurityaffairs.comMay 10, 2026, 8:20 AMLinked URL: https://www.youtube.com/watch?v=szddOzKB-BM | Posted by xphilter | 2 points | 1 comments
communitynews.ycombinator.comMay 9, 2026, 2:32 PMInformation published.
vendormsrc.microsoft.comMay 7, 2026, 8:11 AMLinked URL: https://www.striga.ai/research/apache-httpd-mod-http2-double-free | Posted by mparadys | 8 points | 0 comments
communitynews.ycombinator.comMay 6, 2026, 4:55 PMApache fixed several flaws in HTTP Server, including CVE-2026-23918 (CVSS score of 8.8), a double-free bug in HTTP/2 that could allow remote code execution. The Apache Software Foundation has released updates to fix multiple vulnerabilities in its HTTP Server, including CVE-2026-23918 (CVSS score of 8.8). The issue involves a “double free” error in HTTP/2 handling […]
newssecurityaffairs.comMay 6, 2026, 11:00 AMLinked URL: https://www.openwall.com/lists/oss-security/2026/05/04/19 | Posted by v0id1st | 1 points | 0 comments
communitynews.ycombinator.comMay 6, 2026, 8:07 AMLinked URL: https://www.cve.org/CVERecord?id=CVE-2026-23918 | Posted by IncandescentGas | 7 points | 0 comments
communitynews.ycombinator.comMay 5, 2026, 11:29 PMThe most severe of these security defects could allow remote attackers to execute arbitrary code.
newswww.securityweek.comMay 5, 2026, 11:19 AM- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23918.jsonsecurity.access.redhat.com
No excerpt available.
Vendor Advisorysecurity.access.redhat.comMay 4, 2026, 3:16 PM - https://bugzilla.redhat.com/show_bug.cgi?id=2465304bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comMay 4, 2026, 3:16 PM - https://access.redhat.com/security/cve/CVE-2026-23918access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 4, 2026, 3:16 PM - https://access.redhat.com/errata/RHSA-2026:13938access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 4, 2026, 3:16 PM - http://www.openwall.com/lists/oss-security/2026/05/04/19www.openwall.com
No excerpt available.
Exploitwww.openwall.comMay 4, 2026, 3:16 PM - https://httpd.apache.org/security/vulnerabilities_24.htmlhttpd.apache.org
No excerpt available.
Vendor Advisoryhttpd.apache.orgMay 4, 2026, 3:16 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
1 repository references · best confidence 0.80 · max 0 stars
- gagaltotal/CVE-2026-23918-Double-free-Apache-httpd-mod_http2Medium confidencegithubDiscovery source unavailable0 starsDiscovered Jul 9, 2026, 1:19 AM
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-46189CVSS 7.8 · High
In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_fre…
- CVE-2026-33811CVSS 7.5 · High
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
- CVE-2026-43178CVSS 7.8 · High
In the Linux kernel, the following vulnerability has been resolved: procfs: fix possible double mmput() in do_procmap_query() When user provides incorrectly sized buffer for bui…
- CVE-2026-6654CVSS 5.1 · Medium
Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.
- CVE-2026-17573CVSS 4.0 · Medium
A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to a…
- CVE-2026-66373CVSS 7.5 · High
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry)…