TLDR Tech / InfoSec
Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE
CVE-2026-23918 (CVSS 8.8) is a double-free in Apache httpd 2.4.66 mod_http2's stream cleanup path (h2_mplx.c), triggered when a client sends a HEADERS frame immediately followed by RST_STREAM on the same stream before the multiplexer registers it, causing the same h2_stream pointer to be pushed onto the spurge cleanup array twice. Researchers Bartlomiej Dmitruk (Striga.ai) and Stanislaw Strzalkowski (ISEC.pl) demonstrated a trivial DoS against any default mod_http2 deployment with a multi-threaded MPM, plus a working x86_64 RCE PoC that leverages mmap reuse to plant a fake h2_stream and pivots through Apache's fixed-address scoreboard to call system(), with the RCE path practical on Debian-derived systems and the official httpd Docker image due to the APR mmap allocator default. Defenders should upgrade to 2.4.67 immediately. mod_http2 is included in default builds, and the prefork MPM is the only unaffected configuration.
Read the full story