CVE-2026-23918
EUVD-2026-2695504.05.2026, 15:16
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| apache | http_server | 2.4.66 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Hardened Images | 2.4.67-0.1.hum1 ≤ 𝑥 < * | ADP |
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| apache2 |
| ||||||||||||||||||
| apache2-devel |
| ||||||||||||||||||
| apache2-doc |
| ||||||||||||||||||
| apache2-example-pages |
| ||||||||||||||||||
| apache2-manual |
| ||||||||||||||||||
| apache2-prefork |
| ||||||||||||||||||
| apache2-utils |
| ||||||||||||||||||
| apache2-worker |
|
Amazon Linux Releases
Common Weakness Enumeration
- CWE-415 - Double FreeThe product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
- CWE-1341 - Multiple Releases of Same Resource or HandleThe product attempts to close or release a resource or handle more than once, without any successful open between the close operations.
References