CVE-2026-23918 — Apache HTTP Server mod_http2 Double Free Enabling Unauthenticated DoS and Possible RCE

CVE-2026-23918 (TL-2026-0475), also tracked as Apache HTTP/2 Double Free, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-05-07. It has no confirmed attribution, affects Apache Software Foundation Apache HTTP Server, references 1 CVE (CVE-2026-23918), maps to 15 MITRE ATT&CK techniques (T1046, T1068, T1071.001), and is covered by 9 detection rules and 14 indicators of compromise.

Key facts for TL-2026-0475

Threat ID
TL-2026-0475
Also known as
Apache HTTP/2 Double Free, mod_http2 Stream Cleanup Race
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-05-07
Last reviewed
2026-05-07
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
all, government, financial, healthcare, technology, education, media, retail, telecommunications, manufacturing
Target regions
Global
Detection rules
9
Indicators of compromise
14

Malware and tooling in CVE-2026-23918

Malware and tooling: Apache HTTP Server 2.4.66 advertising h2 or h2c via ALPN on TCP/443 or TCP/80, Public x86_64 PoC for CVE-2026-23918 (lab build by striga.ai/isec.pl reporters)

A critical double-free vulnerability (CVE-2026-23918) in Apache HTTP Server 2.4.66 mod_http2 stream cleanup path lets an unauthenticated remote attacker crash worker processes — and potentially achieve remote code execution — using a single TCP connection and two HTTP/2 frames (HEADERS followed by RST_STREAM with a non-zero error code). The flaw affects all default multi-threaded MPM deployments (event/worker); the prefork MPM is not affected. RCE is feasible against builds using the APR mmap allocator, which is the default on Debian-derived distributions and the official httpd Docker image. Apache fixed the issue in 2.4.67 (released 2026-05-04).

How CVE-2026-23918 works

CVE-2026-23918 is a double-free memory corruption vulnerability in the Apache HTTP Server mod_http2 module's stream cleanup path. The flaw was reported privately to the Apache HTTP Server security team on 2025-12-10 by Bartlomiej Dmitruk (striga.ai) and Stanislaw Strzalkowski (isec.pl), fixed in source revision r1930444 on 2025-12-11, and publicly disclosed alongside the 2.4.67 release on 2026-05-04. Apache rates the issue Critical — its highest severity tier — because the trigger is unauthenticated, network-reachable, and requires only a single TCP connection and two HTTP/2 frames.

The root cause lies in a race condition in mod_http2 between the connection multiplexer (h2_mplx) and the stream cleanup routine. When a client sends an HTTP/2 HEADERS frame opening a new stream and then immediately follows it with an RST_STREAM frame carrying a non-zero error code before the multiplexer has fully registered the stream, the cleanup path is entered twice: once via the early-reset fast path, and once via the stream destructor invoked when the multiplexer subsequently observes the registered-but-already-cancelled stream. Both code paths call apr_pool_destroy on the per-stream pool, freeing the same memory chunks twice. Under the APR mmap allocator the freed regions are returned to a per-thread free list and rapidly reused, so the second free corrupts the allocator metadata of an unrelated, still-live allocation. Under the default APR malloc allocator on Linux distributions like RHEL/Fedora the corruption is typically caught by glibc's tcache double-free protection, producing a clean abort and a worker crash; under the mmap allocator (Debian default, official httpd Docker image default) the protection is absent, leaving an exploitable heap state.

Exploitation primitives: a worker process consuming the malformed frame pair will either (a) abort with a glibc-detected double free message and be replaced by the parent (recoverable but disruptive denial of service if repeated at scale) or (b) continue past the corruption with attacker-influenced metadata, allowing an arbitrary-write primitive that the original reporters used in lab conditions to demonstrate code execution on x86_64 against a default httpd:2.4.66 Docker container. The reporters' write-up explicitly notes that practical RCE in the field requires both an information leak and favorable memory reuse, neither of which are guaranteed across server load and configurations; nonetheless, the worker crash primitive is fully reliable and unauthenticated.

Affected configurations: Apache HTTP Server 2.4.66 with mod_http2 loaded and a multi-threaded MPM (event or worker — the defaults on every modern distribution). The prefork MPM is not affected because each worker handles a single connection in a single thread, removing the race window. Customers running Apache as a TLS-terminating reverse proxy in front of application servers (a common pattern) are particularly exposed because mod_http2 is typically enabled to advertise HTTP/2 to clients. The vulnerability is reachable on any Apache instance that negotiates h2 or h2c on a network-exposed port; it does not require authenticated access, valid Host header, or any application-layer state.

Detection and exposure: as of 2026-05-06 there are no public reports of in-the-wild exploitation, but the trigger pattern is trivially distinguishable from legitimate traffic at the HTTP/2 frame layer. Defenders should watch for clients that immediately follow a HEADERS frame with an RST_STREAM carrying a non-zero error code on the same stream ID, especially at elevated rates from a single source. Worker process restart spikes, mod_http2 error logs containing references to stream cleanup, and glibc-emitted free()-corrupted-double-linked-list or double free or corruption messages in journald/syslog are reliable post-exploit signals. WAFs that operate at HTTP/1.1 semantics will not see the trigger; HTTP/2-aware proxies (envoy, h2 on Nginx) can be configured to drop the offending frame sequence.

Mitigations: upgrade Apache HTTP Server to 2.4.67 immediately. Workarounds for organisations that cannot patch promptly include (1) unloading mod_http2 entirely (LoadModule http2_module commented out), (2) switching to the prefork MPM, (3) disabling Protocols h2 h2c in httpd.conf so only HTTP/1.1 is negotiated, or (4) terminating HTTP/2 at an upstream proxy that does not delegate the trigger frame sequence to Apache. The Apache Software Foundation has not issued a backport for end-of-life branches; users on httpd 2.2 must migrate. The official httpd Docker image was rebuilt on 2026-05-04 with the 2.4.67 base; pinned images at 2.4.66 are vulnerable.

MITRE ATT&CK techniques used in TL-2026-0475

Discovery

T1046 Network Service Discovery

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Defense Evasion

T1211 Exploitation for Stealth

Impact

T1489 Service Stop; T1499 Endpoint Denial of Service; T1499.004 Endpoint Denial of Service: Application or System Exploitation

Persistence

T1505.003 Server Software Component: Web Shell

Resource Development

T1588.005 Obtain Capabilities: Exploits; T1588.006 Obtain Capabilities: Vulnerabilities

Reconnaissance

T1592.002 Gather Victim Host Information: Software; T1595 Active Scanning; T1595.002 Vulnerability Scanning

Affected products and versions in CVE-2026-23918

  • Apache Software Foundation — Apache HTTP Server
    Vulnerable versions: 2.4.66
    Fixed in: 2.4.67
  • Apache Software Foundation — mod_http2
    Vulnerable versions: bundled with httpd 2.4.66
    Fixed in: bundled with httpd 2.4.67
  • Docker — httpd Official Image
    Vulnerable versions: 2.4.66; 2.4.66-bookworm; 2.4.66-alpine
    Fixed in: 2.4.67; 2.4.67-bookworm
  • Debian — apache2 (apt source package)
    Vulnerable versions: 2.4.66-1
    Fixed in: 2.4.67-1
  • Canonical — Ubuntu apache2 package
    Vulnerable versions: 2.4.66-1ubuntu1
    Fixed in: 2.4.67-1ubuntu1

Remediation for CVE-2026-23918

Patches

  • Apache HTTP Server 2.4.67 (released 2026-05-04, source revision r1930444)
  • Official httpd Docker image rebuilt 2026-05-04 with the 2.4.67 base

Immediate actions

  • Upgrade Apache HTTP Server to 2.4.67 on all Internet-facing hosts and reverse proxies
  • If patching is delayed, disable Protocols h2 h2c in httpd.conf so only HTTP/1.1 is negotiated
  • Comment out LoadModule http2_module in mods-enabled/http2.conf as an alternative workaround
  • Rebuild and redeploy any Docker images pinned to httpd:2.4.66 against httpd:2.4.67
  • Block HTTP/2 RST_STREAM frames carrying non-zero error codes immediately following a HEADERS frame at HTTP/2-aware perimeter proxies

Workarounds

  • Switch the MPM from event/worker to prefork (vulnerability does not affect single-threaded workers)
  • Disable mod_http2 by unloading the module
  • Disable HTTP/2 protocol negotiation in httpd.conf
  • Terminate HTTP/2 at an upstream proxy that drops malformed RST_STREAM-after-HEADERS frame pairs

Longer-term hardening

  • Front Apache with an HTTP/2-aware reverse proxy (Envoy or Nginx) that normalises frame sequences
  • Add behavioural detection for spikes in worker process restarts and glibc double-free messages
  • Adopt continuous SCA scanning of httpd binaries and Docker base images for outdated 2.4.x revisions
  • Subscribe operations channels to the Apache HTTP Server announcements list for future advisories
  • Define an out-of-band patch SLA for Critical-rated httpd CVEs measured in hours rather than days

CVEs associated with CVE-2026-23918

CVE-2026-23918

Weaknesses (CWE) in CVE-2026-23918

CWE-415, CWE-416, CWE-362

Timeline of CVE-2026-23918

  • Bartlomiej Dmitruk (striga.ai) and Stanislaw Strzalkowski (isec.pl) privately report the mod_http2 double-free to the Apache HTTP Server security team.
  • Fix committed to the httpd 2.4.x branch as Subversion revision r1930444, hardening the mod_http2 stream cleanup path against the HEADERS-then-RST_STREAM race.
  • Docker Official Library rebuilds the httpd image with the 2.4.67 base; the 2.4.66 tag remains pinnable and vulnerable.
  • Apache Software Foundation publishes the security advisory for CVE-2026-23918 and releases Apache HTTP Server 2.4.67 containing the fix; Critical severity assigned by the project.
  • NVD publishes CVE-2026-23918 with reference set including the Apache advisory, SVN commit, and Debian security tracker entry.
  • SOC Prime and SOCRadar publish independent technical analyses confirming the unauthenticated two-frame DoS primitive and lab-validated x86_64 RCE on the official httpd Docker image.
  • Threadlinqs Intelligence publishes structured threat record TL-2026-0475 with full MITRE mapping, IOCs, and detection coverage.
  • As of 2026-05-29, CVE-2026-23918 (Apache mod_http2 double-free) is fixed in httpd 2.4.67 with distro/Docker rebuilds, not in CISA KEV, and EPSS <1% with no confirmed in-the-wild campaigns. It stays a live concern because a public PoC and a trivial unauthenticated worker-crash DoS still work against the large unpatched 2.4.66 base.

Sources cited for CVE-2026-23918

Threats related to CVE-2026-23918

Detection coverage for TL-2026-0475

As of 2026-05-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0475 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats