CVE intelligence

CVE-2026-23918

Vulnerability intelligence

Published May 4, 2026Sources checked Nov 11, 2026

8.8HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2026-23918 and is rated High severity with a CVSS score of 8.8. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

Public exploit: Cataloged public exploit.

Exploit-DB: Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service (2026-09-23 21:40:27.335989+00)
Exploit-DB lists a public exploit or proof of concept for this CVE. SecurityAlert has not executed it; this is not evidence of attacks against your systems.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Aug 10, 2026

CBL-Mariner Releases

Vendor-listed releases

2.4.67-1

CISA KEVNot listedBased on the latest collected catalog

EPSS49.7%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-23918?

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.

This issue affects Apache HTTP Server: 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Source: NVD