Critical Apache HTTP/2 Flaw CVE-2026-23918 Enables DoS and Remote Code Execution

The Apache Software Foundation has released an urgent security update addressing a critical vulnerability in Apache HTTP Server that can be exploited to trigger denial-of-service and, under specific conditions, achieve remote code execution on affected systems worldwide.

The vulnerability, tracked as CVE-2026-23918 with a CVSS score of 8.8, affects Apache HTTP Server version 2.4.66 and has been resolved in version 2.4.67. The official advisory describes the issue as a "double free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol." Organisations running mod_http2 on multi-threaded deployments are directly exposed and should apply the patch without delay.

The flaw was discovered and responsibly disclosed by Bartlomiej Dmitruk, co-founder of Striga.ai, and Stanislaw Strzalkowski, a researcher at ISEC.pl.

What the Vulnerability Is and How It Triggers

CVE-2026-23918 is a double-free vulnerability located in the stream cleanup path of the h2_mplx.c file within Apache's mod_http2 module. The bug is triggered by a specific two-frame sequence:

• Step 1: The client sends an HTTP/2 HEADERS frame on a given stream.
• Step 2: Immediately afterwards, the client sends an RST_STREAM frame carrying a non-zero error code on the same stream, before the multiplexer has had the opportunity to register it.

When this sequence occurs, two nghttp2 callbacks fire in succession. Both the on_frame_recv_cb callback for the RST and the on_stream_close_cb callback for the close invoke h2_mplx_c1_client_rst, which then calls m_stream_cleanup. This pushes the same h2_stream pointer onto the cleanup array twice. When c1_purge_streams later iterates the array and calls h2_stream_destroy on each entry, the second call operates on memory that has already been freed, producing the double-free condition and resulting in memory corruption.

Two Confirmed Exploitation Outcomes

Outcome 1: Denial-of-Service

The denial-of-service path is trivial to execute and works on any default deployment running mod_http2 with a multi-threaded MPM. It requires only one TCP connection and two frames, with no authentication, no special headers, and no specific URL required.

When the worker process crashes, Apache automatically respawns it. Every request on the crashed worker is dropped in the process. Because the crash-and-respawn cycle can be sustained indefinitely as long as the attacker continues sending the two-frame sequence, this constitutes an effective mechanism for persistent service disruption, with no meaningful barrier to entry.

Outcome 2: Remote Code Execution

The remote code execution path is more complex but has been confirmed with a working proof of concept developed and tested on x86_64 architecture. The exploit chain places a fake h2_stream struct at the freed virtual address via mmap reuse, points its pool cleanup function to system(), and uses Apache's scoreboard memory as a stable container for the fake structures and the command string.

Critically, the scoreboard sits at a fixed address for the lifetime of the server, even with Address Space Layout Randomisation (ASLR) enabled. While practical exploitation typically requires an information leak to locate system(), the fixed nature of the scoreboard address on many distributions significantly lowers the bar for a successful exploit. An attacker who knows the Apache version and build in use can calculate the scoreboard offsets without requiring a dynamic leak. In lab conditions, code execution was achieved within minutes.

Which Systems Are at Elevated Risk

The RCE path specifically requires an Apache Portable Runtime (APR) configured with the mmap allocator. This is the default configuration on:

• Debian-derived Linux distributions, including Ubuntu Server editions widely used across enterprise environments.
• The official Apache httpd Docker image, which is the base image for a large number of containerised web application deployments.
• Cloud-hosted instances on AWS, Microsoft Azure, and Google Cloud Platform that run Debian-based Amazon Machine Images (AMIs) or use the official Apache Docker image as their web server layer. This covers a substantial proportion of production Apache deployments across both private and public cloud infrastructure globally.

MPM prefork is not affected by this vulnerability. However, mod_http2 ships enabled in default Apache builds and HTTP/2 is widely deployed in production environments, making the overall attack surface significant. As Security Affairs noted, the widespread adoption of HTTP/2 substantially increases exposure even where the specific RCE conditions are not met.

Recommended Action

All organisations running Apache HTTP Server 2.4.66 with mod_http2 enabled should update to version 2.4.67 without delay. The update is available directly from the Apache Software Foundation's official downloads page.

For organisations that cannot patch immediately, disabling mod_http2 is an effective interim mitigation for both the DoS and RCE vectors.

Given the trivial nature of the DoS exploitation path, the existence of a working RCE proof of concept, and the reduced complexity introduced by the fixed scoreboard address, this vulnerability warrants immediate treatment as an active threat rather than a routine patch-cycle item. Security and infrastructure teams should audit all Apache HTTP Server deployments, with particular urgency for any instance running on Debian-based systems, containerised via Docker, or hosted on cloud platforms using default AMI configurations.