8.8
/ 10
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
CVE-2026-23918 Double-free in Apache httpd modhttp2 stream cleanup leading to pre-auth RCE. Affected: httpd 2.4.66 with modhttp2 and multi-threaded MPM event/worker. Fixed in: 2.4.67. Found and reported by Bartlomiej Dmitruk striga.ai and Stanislaw...
Basic Information
ID
8A69D3F8-27C0-508D-B54A-79182141AB36
Published
May 11, 2026 at 14:07
Modified
May 11, 2026 at 14:08