Apache HTTP Server CVE-2026-23918

Requires Apache HTTP Server 2.4.66 with HTTP/2 protocol enabled (mod_http2 loaded). Attacker must possess valid low-privilege authentication credentials (PR:L) to establish an HTTP/2 session - this could be any authenticated user account, including customer accounts in web applications, authenticated API consumers, or shared hosting tenants. No user interaction required (UI:N). Exploitation is limited to servers running the exact affected version 2.4.66; earlier versions (2.4.65 and below) and patched 2.4.67 are not vulnerable. Default Apache configurations with HTTP/2 enabled are exploitable if authentication mechanisms are present. Deployments with HTTP/2 disabled or running HTTP/1.1-only are not affected regardless of version.

Real-world risk is elevated but constrained by authentication requirements. CVSS 8.8 reflects network-based attack vector (AV:N), low complexity (AC:L), and complete CIA impact (C:H/I:H/A:H), but requires low-privilege authentication (PR:L). SSVC framework confirms no current exploitation and rates the flaw as non-automatable, requiring attacker interaction with authenticated HTTP/2 sessions. EPSS data not provided, but absence from CISA KEV and no POC availability suggest exploitation is not yet widespread or publicly demonstrated. The total technical impact rating (complete system compromise) elevates priority despite auth requirements. Primary risk exists in environments where untrusted users have legitimate HTTP/2 access (shared hosting, authenticated APIs, customer portals). Organizations should prioritize patching authenticated-access servers over internet-facing anonymous endpoints. The narrow affected version range (single release 2.4.66) limits exposure - many deployments may remain on earlier stable branches. Verify actual deployment of 2.4.66 before prioritizing, as organizations on 2.4.62-2.4.65 or earlier branches are not affected by this specific double-free.

An authenticated attacker with low-privilege credentials (PR:L) establishes an HTTP/2 connection to the vulnerable Apache 2.4.66 server and sends specially crafted HTTP/2 frames that trigger the double-free condition in the stream or connection management code. By manipulating subsequent memory allocations, the attacker overwrites heap metadata to redirect execution flow, achieving arbitrary code execution with the privileges of the Apache worker process (typically www-data or apache user). From this foothold, the attacker deploys web shells, exfiltrates application data, or escalates privileges via kernel exploits. No public proof-of-concept exists at time of analysis, but the low attack complexity (AC:L) indicates exploitation is straightforward once an authenticated session is obtained.