PT-2026-36811 · Apache+2 · Apache Http Server+2

Bartlomiej Dmitruk + 1 · Published 2025-12-10 · Updated 2026-06-15 · CVE-2026-23918

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache HTTP Server version 2.4.66

Description A double free condition exists in the HTTP/2 implementation of the Apache HTTP Server, specifically within the mod http2 module. A double free occurs when the software attempts to release the same memory space twice, which can corrupt heap structures. This flaw allows a remote, unauthenticated attacker to execute arbitrary code or cause a denial of service by sending specially crafted HTTP/2 traffic. The issue is particularly critical for servers handling multiple tenants or user-driven content, as attackers can establish numerous connections and streams to trigger the flaw. Standard authentication methods, such as basic authentication or reverse proxy authentication, do not prevent the establishment of these malicious connections.

Recommendations Upgrade to version 2.4.67.

Exploit

Fix

DoS

RCE

NULL Pointer Dereference

Double Free

Weakness Enumeration

CWE-476

CWE-415

Related Identifiers

BDU:2026-06305

BDU:2026-06409

BIT-APACHE-2026-23918

CVE-2026-23918

OPENSUSE-SU-2026:10785-1

RHSA-2026:13938

USN-8239-1

Affected Products

Apache Http Server

Linuxmint

Ubuntu

References · 215

• 🔥 https://exploit-db.com/exploits/52577 · Exploit
• https://ubuntu.com/security/CVE-2026-28780 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8239-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-29169 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34032 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-apache-2026-23918 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-23918 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23918 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10785-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23918 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/732140 · Security Note
• https://osv.dev/vulnerability/USN-8239-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33857 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06305 · Security Note
• https://ubuntu.com/security/CVE-2026-33006 · Vendor Advisory