A memory-corruption bug in Apache HTTP Server’s HTTP/2 implementation was publicly disclosed this week, and the details are ugly enough that you should stop reading this sentence and go check your Apache version right now. Done? Good. Let’s talk about what’s actually going on.

The Bug

CVE-2026-23918 is a double-free vulnerability in mod_http2, specifically in the stream cleanup path of Apache httpd 2.4.66. A double-free happens when code tries to release the same chunk of memory twice — a classic mistake that corrupts internal allocator state and typically leads to crashes, and sometimes worse.

The “sometimes worse” is the part that earned this a CVSS score of 8.8. An attacker can trigger the bug by sending an HTTP/2 HEADERS frame immediately followed by a RST_STREAM frame on the same stream, before the server’s multiplexer has finished setting up that stream. At minimum this causes a denial-of-service. Under certain memory-allocator configurations it can escalate to remote code execution.

To be clear: the RCE path requires the Apache Portable Runtime to be using the mmap allocator, which is not the default on most Linux distros. But “not default” is not the same as “never happens,” and the DoS vector alone is enough of a headache for any production web server.

Who Is Affected

Only Apache HTTP Server 2.4.66 is affected. If you are running any earlier version with HTTP/2 enabled you should probably update anyway, but this specific CVE targets 2.4.66 exactly. The fix is in 2.4.67, released this week.

What To Do

Option A — Update. The cleanest solution is upgrading to 2.4.67. On Debian/Ubuntu:

apt update && apt install apache2

On RHEL/AlmaLinux/Rocky, check whether a patched package is available in your distribution repos. The upstream fix is in place; distro packaging may lag by a few days.

Option B — Disable HTTP/2 temporarily. If you cannot update immediately, disabling HTTP/2 blocks the attack vector entirely. In your Apache configuration:

Protocols http/1.1

Remove or comment out any Protocols h2 http/1.1 line and restart Apache. Your sites will still work — they will fall back to HTTP/1.1. Performance-sensitive applications may notice, but everyone stays online.

Check your version first:

apache2 -v
# or
httpd -v

If you see 2.4.66, you need to act. If you see 2.4.67 or later, you are already covered.

A Note About HTTP/2 in General

This bug is a good reminder that HTTP/2 — for all its benefits in multiplexing and header compression — adds significant complexity to the request-handling path. More complexity means more attack surface. That is not an argument against using it; it is an argument for keeping your server software current and having a patch-deployment process that does not take three weeks.

Shared hosting environments deserve particular attention here. A single Apache instance serving dozens of virtual hosts can be taken offline by one malformed sequence of HTTP/2 frames. You do not need to authenticate, you do not need an account — you just need a network path to port 443.

What This Means for kalfaoglu.net Customers

Our servers run Apache, and we monitor upstream security advisories as a routine part of operations. We are tracking CVE-2026-23918 and updating affected servers to 2.4.67 as packages become available in our distribution repositories. HTTP/2 configuration is being reviewed on each server in the meantime. If you manage your own VPS and handle your own Apache updates, the action items above are for you — please do not sleep on this one.

If you are on shared hosting with us and are worried, open a support ticket. We will tell you exactly which Apache version is running on your server.

The Takeaway

  • CVE: CVE-2026-23918
  • Affected version: Apache HTTP Server 2.4.66
  • Fixed version: Apache HTTP Server 2.4.67
  • Severity: CVSS 8.8 (High)
  • Impact: Denial-of-service; potential RCE under specific memory-allocator conditions
  • Mitigation: Upgrade to 2.4.67, or disable HTTP/2 with Protocols http/1.1

The Hacker News coverage has a solid technical breakdown if you want the full stream-reset sequence explained. The OpenCVE entry is the canonical tracker.

Patch early, patch often. The internet is not a forgiving place.