PT-2026-36811 · Apache · Apache Http Server

Bartlomiej Dmitruk + 1 · Published 2026-05-04 · Updated 2026-05-05 · CVE-2026-23918

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.66 and earlier

Description A double free issue exists in the HTTP/2 protocol implementation, which could potentially lead to remote code execution (RCE), a state where an attacker can execute arbitrary commands on the target machine.

Recommendations Upgrade to version 2.4.67. Disable HTTP/2 if it is not required. Monitor for suspicious traffic or resets.

Fix

RCE

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2026-23918

Affected Products

Apache Http Server

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-23918 · Security Note
• https://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• https://twitter.com/UndercodeUpdate/status/2051514621840838821 · Twitter Post
• https://twitter.com/oss_security/status/2051500973084828145 · Twitter Post
• https://twitter.com/UpwindMDR/status/2051340165692436991 · Twitter Post
• https://twitter.com/catnap707/status/2051537314900557957 · Twitter Post
• https://twitter.com/tuxnet_work/status/2051483571643150592 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2051349880463823058 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2051484965725216984 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/04/19 · Note