Critical Apache HTTP/2 Vulnerability (CVE-2026-23918): DoS and Potential RCE

Colleagues, a critical vulnerability in Apache HTTP/2 (CVE-2026-23918) has been disclosed.

- Reported by Bartlomiej Dmitruk (Striga.ai) and Stanislaw Strzalkowski (ISEC.pl).
- Issue: double-free in mod_http2 (stream cleanup) in httpd 2.4.66; fixed in 2.4.67.
- Risk: trivial DoS on default configurations; possible RCE when APR uses mmap (the default in Debian and official Docker images).
- MPM prefork is not affected.

Why this matters: mod_http2 is often enabled by default — update servers urgently.

How will you respond?

#cybersecurity #Apache #HTTP2 #vulnerabilities