CVE intelligence

CVE-2026-23918

Vulnerability intelligence

Published May 4, 2026Sources checked Sep 27, 2026

8.8HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2026-23918 and is rated High severity with a CVSS score of 8.8. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

Public exploit: Cataloged public exploit.

Exploit-DB: Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service (2026-09-23 21:40:27.335989+00)

CISA KEVNot listedBased on the latest collected catalog

EPSS49.7%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-23918?

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.