CVE-2026-23918: Apache httpd 2.4.66 HTTP/2 double free on early reset (important)

High 8.8 EPSS 49.7% Apache HTTP Server

Apache HTTP Server 2.4.66 contains a double free in its HTTP/2 handling (early stream reset) that the Apache project rates important and describes as a possible remote code execution. Any internet-facing 2.4.66 server with mod_http2 enabled is reachable by unauthenticated clients. Only 2.4.66 is affected: Red Hat Enterprise Linux and Ubuntu 22.04/24.04 packages are not affected, while distributions that shipped 2.4.66 (for example Debian 13, Ubuntu 26.04 and SUSE) have published fixes.

CVE-2026-23918CVE identifier
8.8CVSS 3.1 base score (high)
49.7%EPSS: chance of exploitation in the next 30 days (higher than 99% of CVEs)
2026-05-04published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

Check whether you run Apache HTTP Server and which version (commands below).
Install the fixed version for your system: see “Patch it” below.
Restart Apache (systemctl restart apache2 on Debian/Ubuntu/SUSE, systemctl restart httpd on RHEL-family) so all child processes run the fixed mod_http2.
If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.

Affected and fixed versions

Affected:

Apache HTTP Server 2.4.66

Fixed in:

Apache HTTP Server 2.4.67

Am I affected?

apache2 -v || httpd -v
apache2ctl -M 2>/dev/null | grep http2 || httpd -M 2>/dev/null | grep http2
dpkg -l apache2 | grep ^ii

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Debian

sudo apt update
sudo apt install --only-upgrade apache2 apache2-bin apache2-data apache2-utils
sudo systemctl restart apache2

Ubuntu

sudo apt update
sudo apt install --only-upgrade apache2 apache2-bin apache2-data apache2-utils
sudo systemctl restart apache2

RHEL, AlmaLinux, Rocky, Oracle

sudo dnf upgrade --refresh httpd

Fedora

sudo dnf upgrade --refresh httpd

SUSE / openSUSE

sudo zypper refresh
sudo zypper update apache2
sudo systemctl restart apache2

Amazon Linux

sudo dnf upgrade --releasever=latest httpd

Arch Linux

sudo pacman -Syu

Alpine

apk update && apk upgrade apache2

FreeBSD

pkg update && pkg upgrade apache24

Built from source

Upgrade to Apache HTTP Server 2.4.67 or later (2.4.69 is current and also fixes later issues) from https://httpd.apache.org/download.cgi, then restart httpd.

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

Release	Package	Status	Fixed version / advisory
Debian 12	`apache2`	fixed	`2.4.67-1~deb12u2`
Debian 13	`apache2`	fixed	`2.4.66-1~deb13u2`
Debian testing	`apache2`	fixed	`2.4.66-5`
Debian 13 (trixie)	`apache2`	fixed	`2.4.66-1~deb13u2`
Debian 12 (bookworm)	`apache2`	fixed	`2.4.67-1~deb12u2`
Ubuntu 26.04 LTS (resolute)	`apache2`	fixed	`2.4.66-2ubuntu2.1 (USN-8239-1)`
SUSE Linux Enterprise Server 16.0	`apache2`	fixed	`2.4.66-160000.2.1`
SUSE Linux Enterprise Server 15 SP7	`apache2`	fixed	`2.4.66-150700.4.20.1`
SUSE Linux Enterprise Server 15 SP6-LTSS	`apache2`	fixed	`2.4.66-150600.5.52.1`

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

Red Hat: disable mod_http2 by commenting out or removing the 'LoadModule http2_module modules/mod_http2.so' line (e.g. in /etc/httpd/conf.modules.d/), then restart httpd. On Debian/Ubuntu the equivalent is 'sudo a2dismod http2 && sudo systemctl restart apache2'. This disables HTTP/2 for all sites.

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.