There’s a flaw in the mod_http2 module. It affects Apache HTTP Server 2.4.66 and earlier.
A single malicious request is enough to hit the server. On some servers it can go as far as code execution.
First, let’s take a quick look at what HTTP/2 is:
In the old HTTP/1.1, the browser opened a separate connection for each file. HTTP/2 opens parallel channels called “streams” over a single connection.
Each stream is split into small packets, and these packets are called “frames”. So a stream is a conversation, and frames are the individual sentences in that conversation.
The attacker sends two frames in a row. First HEADERS (the frame that starts a new stream), then right after it RST_STREAM (the frame that cancels a stream).
Normally there’s a bit of a gap between these two frames, and the server records the new stream in its books. But here the attacker doesn’t leave that gap.
That’s exactly where the bug blows up. mod_http2 sees the cancel request before it has officially registered the stream. It frees the memory it allocated once.
Then it tries to free it again because “the stream is already canceled”. Freeing the same memory twice is called a “double-free” in the programming world, and it has dangerous consequences.
HEADERS frame - stream id=1 opens
RST_STREAM frame - stream id=1 canceled (but it wasn't registered yet)
server frees the memory twice - down
So what happens? The mildest scenario: the Apache process crashes. Even if the server restarts, the attacker repeats the command and the site keeps going down. In other words, DoS, denial of service.
The bad scenario is more troubling. Apache installed from the Debian package and the official Docker images use a different memory allocator (APR mmap).
There, the double-free can let the attacker control certain structures in memory. Researchers confirmed the possibility of remote code execution (RCE) through this. That means the attacker can end up running commands on the server.
Active exploitation hasn’t been confirmed yet, but with ready-made code out there, that won’t take long.
The fix is clear. The Apache 2.4.67 update came out on May 4 and includes the patch. If you don’t use mod_http2, disabling the module is also a temporary fix. But HTTP/2 comes enabled by default in production. Most admins think it’s off, but it turns out to be on.
apachectl -M | grep http2With this command you can check whether mod_http2 is loaded. If it is, you need to look at the version.
httpd -vIf it’s 2.4.66 or lower, update right away. If your package manager doesn’t provide it, get 2.4.67 from the official Apache site.
The truly dangerous side of this flaw is this: HTTP/2 is the backbone of today’s internet. Browsers prefer it by default, CDNs use it, and almost every major site runs it. So if someone had been scanning before the patch came out, the target list would be huge.
Source:
https://nvd.nist.gov/vuln/detail/CVE-2026-23918