Loading story…
The Apache Software Foundation released Apache HTTP Server 2.4.67 to fix five vulnerabilities, led by CVE-2026-23918, an important- to high-severity flaw in the HTTP/2 implementation. Apache said the bug is a double free triggered by an early reset that could lead to remote code execution, and that it affects version 2.4.66. The issue was reported in December 2025 and fixed shortly afterward, with public disclosure following on the oss-sec mailing list; Bartlomiej Dmitruk of striga.ai and Stanislaw Strzalkowski of isec.pl were credited with finding it.
The 2.4.67 release also patches CVE-2026-24072 in mod_rewrite, which can allow local .htaccess authors to read arbitrary files as the httpd user, along with lower-severity issues in mod_proxy_ajp, mod_md, and mod_dav_lock. Apache and downstream reporting urged organizations running 2.4.66 or earlier to upgrade immediately, while temporary mitigations for environments that cannot patch at once include disabling HTTP/2, removing mod_dav_lock, and reviewing .htaccess permissions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-06, Striga published a write-up describing how an early HEADERS plus RST_STREAM sequence in mod_http2 could enqueue the same h2_stream pointer twice for cleanup, leading to a double free. The post also claimed a single connection with two HTTP/2 frames could crash a worker process and that lab testing achieved code execution with known system() and scoreboard addresses.
Apache publicly disclosed CVE-2026-23918 on the oss-sec mailing list on 2026-05-04. The advisory described the flaw as an important-severity HTTP/2 double free with possible remote code execution on early reset.
On 2026-05-04, the Apache Software Foundation released Apache HTTP Server 2.4.67, patching five vulnerabilities including CVE-2026-23918. Apache recommended upgrading from 2.4.66 to 2.4.67 to remediate the HTTP/2 double-free issue.
Apache fixed CVE-2026-23918 shortly after it was reported in December 2025. The issue affected Apache HTTP Server 2.4.66 and the remediation was prepared for a later public release.
Bartlomiej Dmitruk of striga.ai and Stanislaw Strzalkowski of isec.pl reported CVE-2026-23918 to Apache in December 2025. The flaw is a double free in Apache HTTP Server's HTTP/2 handling that could lead to remote code execution on early reset.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesocprime.com
Open sourcesecurityaffairs.com
Open sourceccb.belgium.be
Open sourcedownloads.apache.org
Open sourceopennet.me
Open sourceseclists.org
Open sourceopenwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache HTTP Server disclosed **CVE-2026-23918**, a high-severity double-free flaw in `mod_http2` affecting version `2.4.66`, with researchers showing it can be triggered remotely over a single TCP connection by sending crafted HTTP/2 frames on the same stream. The bug stems from the same `h2_stream` object being queued twice for cleanup, causing a second `apr_pool_destroy` on freed memory; on multi-threaded MPM deployments such as **event** and **worker**, this can reliably crash worker processes without authentication, while **prefork** is not affected. Public reporting said denial-of-service is the most practical near-term outcome, but under specific conditions the memory corruption can be developed into pre-authenticated remote code execution. Apache fixed the issue in **version 2.4.67** by preventing duplicate cleanup entries and urged administrators to upgrade immediately. Guidance published alongside the disclosure recommended temporarily disabling **HTTP/2** where patching is delayed, using rate limiting or a WAF to reduce opportunistic abuse, and reviewing exposure from related modules after the same release also patched flaws in `mod_rewrite`, `mod_proxy_ajp`, `mod_md`, and `mod_dav_lock`. At the time of publication, sources said there was **no confirmed in-the-wild exploitation**, but warned that Apache HTTP Server's broad deployment and common `mod_http2` enablement make internet-facing systems attractive targets.
Jun 29, 2026
The Apache Software Foundation released **Apache HTTP Server 2.4.68** to patch 13 vulnerabilities affecting versions prior to `2.4.68`, with many issues spanning `2.4.0` through `2.4.67`. The flaws span multiple modules, including `mod_http2`, `mod_proxy_ftp`, `mod_proxy_html`, `mod_ssl`, `mod_ldap`, `mod_dav_fs`, `mod_xml2enc`, and `mod_headers`, and include use-after-free, heap and buffer overflows, out-of-bounds reads, denial-of-service conditions, cross-site scripting, privilege-escalation and path-handling weaknesses. Apache and national defenders, including Canada’s Cyber Centre, urged administrators to review the advisory and upgrade because workarounds are unavailable for most of the issues. Notable CVEs include `CVE-2026-49975`, a `mod_http2` denial-of-service bug triggered by excessive size values in malicious HTTP/2 requests; `CVE-2026-48913`, a `mod_http2` memory-corruption issue when file handles are exhausted; `CVE-2026-34355` and `CVE-2026-34356`, buffer-overflow flaws tied to untrusted backend systems in `mod_proxy_html` and `ProxyPassReverseCookie*`; `CVE-2026-44631`, a heap underflow in `ap_regname` caused by crafted regular expressions; `CVE-2026-29167`, a `mod_ldap` per-directory use-after-free; `CVE-2026-29170` and `CVE-2026-44186` in `mod_proxy_ftp`; `CVE-2026-44185` in `mod_ssl` OCSP handling; and `CVE-2026-42535` in `mod_dav_fs`. The release also ships non-security changes such as OpenSSL 4.0 support and `mod_http2` updates, but the immediate priority for exposed environments is upgrading all Apache HTTP Server deployments to `2.4.68`.
Jun 29, 2026
The Apache Software Foundation updated its Apache HTTP Server `2.4` vulnerability record to include fixes in version `2.4.68`, with two CVEs credited to AISLE Research. Apache’s official security page lists the flaws among `httpd` vulnerabilities affecting the `2.4` branch, while separate reporting notes that the issues were accepted as distinct CVEs and tracked under Apache’s upstream severity classifications. The disclosures indicate the vulnerabilities were addressed as part of the `2.4.68` release and formally attributed by Apache to AISLE Research, adding to the project’s broader stream of externally reported security findings. Public reporting did not provide deep technical exploitation details, but the references show the issues were recognized by Apache as legitimate security defects requiring remediation in supported `httpd` deployments.
Jul 20, 2026