# CVE-2026-23918 — Apache HTTP Server mod_http2 Double Free Enabling Unauthenticated DoS and Possible RCE

> A critical double-free vulnerability (CVE-2026-23918) in Apache HTTP Server 2.4.66 mod_http2 stream cleanup path lets an unauthenticated remote attacker crash worker processes — and potentially achieve remote code execution — using a single TCP connection and two HTTP/2 frames (HEADERS followed by RST_STREAM with a non-zero error code). The flaw affects all default multi-threaded MPM deployments (event/worker); the prefork MPM is not affected. RCE is feasible against builds using the APR mmap allocator, which is the default on Debian-derived distributions and the official httpd Docker image. Apache fixed the issue in 2.4.67 (released 2026-05-04).

- **Published:** 2026-05-07T12:00:00Z
- **Last reviewed:** 2026-05-07T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0475
- **ID:** TL-2026-0475
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-23918

## Description

CVE-2026-23918 is a double-free memory corruption vulnerability in the Apache HTTP Server mod_http2 module's stream cleanup path. The flaw was reported privately to the Apache HTTP Server security team on 2025-12-10 by Bartlomiej Dmitruk (striga.ai) and Stanislaw Strzalkowski (isec.pl), fixed in source revision r1930444 on 2025-12-11, and publicly disclosed alongside the 2.4.67 release on 2026-05-04. Apache rates the issue Critical — its highest severity tier — because the trigger is unauthenticated, network-reachable, and requires only a single TCP connection and two HTTP/2 frames.

The root cause lies in a race condition in mod_http2 between the connection multiplexer (h2_mplx) and the stream cleanup routine. When a client sends an HTTP/2 HEADERS frame opening a new stream and then immediately follows it with an RST_STREAM frame carrying a non-zero error code before the multiplexer has fully registered the stream, the cleanup path is entered twice: once via the early-reset fast path, and once via the stream destructor invoked when the multiplexer subsequently observes the registered-but-already-cancelled stream. Both code paths call apr_pool_destroy on the per-stream pool, freeing the same memory chunks twice. Under the APR mmap allocator the freed regions are returned to a per-thread free list and rapidly reused, so the second free corrupts the allocator metadata of an unrelated, still-live allocation. Under the default APR malloc allocator on Linux distributions like RHEL/Fedora the corruption is typically caught by glibc's tcache double-free protection, producing a clean abort and a worker crash; under the mmap allocator (Debian default, official httpd Docker image default) the protection is absent, leaving an exploitable heap state.

Exploitation primitives: a worker process consuming the malformed frame pair will either (a) abort with a glibc-detected double free message and be replaced by the parent (recoverable but disruptive denial of service if repeated at scale) or (b) continue past the corruption with attacker-influenced metadata, allowing an arbitrary-write primitive that the original reporters used in lab conditions to demonstrate code execution on x86_64 against a default httpd:2.4.66 Docker container. The reporters' write-up explicitly notes that practical RCE in the field requires both an information leak and favorable memory reuse, neither of which are guaranteed across server load and configurations; nonetheless, the worker crash primitive is fully reliable and unauthenticated.

Affected configurations: Apache HTTP Server 2.4.66 with mod_http2 loaded and a multi-threaded MPM (event or worker — the defaults on every modern distribution). The prefork MPM is not affected because each worker handles a single connection in a single thread, removing the race window. Customers running Apache as a TLS-terminating reverse proxy in front of application servers (a common pattern) are particularly exposed because mod_http2 is typically enabled to advertise HTTP/2 to clients. The vulnerability is reachable on any Apache instance that negotiates h2 or h2c on a network-exposed port; it does not require authenticated access, valid Host header, or any application-layer state.

Detection and exposure: as of 2026-05-06 there are no public reports of in-the-wild exploitation, but the trigger pattern is trivially distinguishable from legitimate traffic at the HTTP/2 frame layer. Defenders should watch for clients that immediately follow a HEADERS frame with an RST_STREAM carrying a non-zero error code on the same stream ID, especially at elevated rates from a single source. Worker process restart spikes, mod_http2 error logs containing references to stream cleanup, and glibc-emitted free()-corrupted-double-linked-list or double free or corruption messages in journald/syslog are reliable post-exploit signals. WAFs that operate at HTTP/1.1 semantics will not see the trigger; HTTP/2-aware proxies (envoy, h2 on Nginx) can be configured to drop the offending frame sequence.

Mitigations: upgrade Apache HTTP Server to 2.4.67 immediately. Workarounds for organisations that cannot patch promptly include (1) unloading mod_http2 entirely (LoadModule http2_module commented out), (2) switching to the prefork MPM, (3) disabling Protocols h2 h2c in httpd.conf so only HTTP/1.1 is negotiated, or (4) terminating HTTP/2 at an upstream proxy that does not delegate the trigger frame sequence to Apache. The Apache Software Foundation has not issued a backport for end-of-life branches; users on httpd 2.2 must migrate. The official httpd Docker image was rebuilt on 2026-05-04 with the 2.4.67 base; pinned images at 2.4.66 are vulnerable.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Vulnerability Scanning
- T1592.002 Gather Victim Host Information: Software
- T1588.005 Obtain Capabilities: Exploits
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1505.003 Server Software Component: Web Shell
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1046 Network Service Discovery
- T1071.001 Application Layer Protocol: Web Protocols
- T1499 Endpoint Denial of Service
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1489 Service Stop

## Sources

- [Apache HTTP Server 2.4 Vulnerabilities — CVE-2026-23918](https://httpd.apache.org/security/vulnerabilities_24.html)
- [Apache HTTP Server 2.4.67 Release Announcement](https://httpd.apache.org/announcements/2.4.html)
- [Apache HTTP Server CHANGES_2.4 — 2.4.67 entries](https://github.com/apache/httpd/blob/2.4.x/CHANGES)
- [Apache Subversion commit r1930444 — mod_http2 stream cleanup race fix](https://svn.apache.org/viewvc?view=revision&revision=1930444)
- [CVE-2026-23918: Critical Apache HTTP/2 Flaw Can Trigger DoS and Possible RCE](https://socprime.com/blog/cve-2026-23918-analysis/)
- [CVE-2026-23918: Apache HTTP Server HTTP/2 Double Free With Possible RCE](https://socradar.io/blog/cve-2026-23918-apache-http-server-http-2/)
- [NVD Entry — CVE-2026-23918](https://nvd.nist.gov/vuln/detail/CVE-2026-23918)
- [Docker Official Image: httpd — security update 2.4.67](https://hub.docker.com/_/httpd)
- [Debian Security Tracker — CVE-2026-23918](https://security-tracker.debian.org/tracker/CVE-2026-23918)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0475