CVE-2026-23918 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.8 HIGH	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 18%

Affected Products (NVD)

Vendor	Product	Version
apache	http_server	2.4.66

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

apache2

bookworm	vulnerable
bookworm (security)	2.4.67-1~deb12u2 fixed
bullseye	2.4.62-1~deb11u1 fixed
bullseye (security)	2.4.67-1~deb11u1 fixed
forky	2.4.66-8 fixed
sid	2.4.67-1 fixed
trixie	2.4.66-1~deb13u2 fixed
trixie (security)	2.4.67-1~deb13u2 fixed

Ubuntu Releases

Ubuntu Product

Codename

apache2

bionic	not-affected
focal	not-affected
jammy	not-affected
noble	not-affected
questing	not-affected
resolute	Fixed 2.4.66-2ubuntu2.1 released
trusty	not-affected
xenial	not-affected

Common Weakness Enumeration

CWE-415 - Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

Vulnerability Media Exposure

[ENGLISH] Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE
The Apache Software Foundation (ASF) has released security updates to address several security vulnerabilities in the HTTP Server, including a severe vulnerability that could potentially lead to remote code execution (RCE). The vulnerability, tracked as CVE-2026-23918 (CVSS score: 8.8), has been described as a case of "double free and possible RCE" in the HTTP/2 protocol handling. This issue
Published: 2026-05-05T21:49:00+05:30
[GERMAN] Apache HTTP Server: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
Published: 2026-05-04T22:00:00+00:00
[GERMAN] Apache HTTP Server: Hochriskante Lücken ermöglichen Einschleusen von Schadcode
Im Apache HTTP Server 2.4.67 stopfen die Entwickler mehrere Sicherheitslücken, die teils das Einschleusen von Schadcode ermöglichen.
Published: 2026-05-06T11:28:00+00:00

References

https://httpd.apache.org/security/vulnerabilities_24.html

http://www.openwall.com/lists/oss-security/2026/05/04/19