[<prev] [next>] [day] [month] [year] [list]
Message-ID: <3863440f-3cfe-87fb-d3f7-0bc1b0f06209@apache.org>
Date: Mon, 04 May 2026 14:05:56 +0000
From: Eric Covener <covener@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-23918: Apache HTTP Server: http2: double free and
possible RCE on early reset
Severity: important
Affected versions:
- Apache HTTP Server 2.4.66
Description:
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.
This issue affects Apache HTTP Server: 2.4.66.
Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Credit:
Bartlomiej Dmitruk, striga.ai (finder)
Stanislaw Strzalkowski, isec.pl (finder)
References:
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-23918
Timeline:
2025-12-10: reported in PR 69899
2025-12-11: fixed in r1930444, r1930796
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
