Critical Apache HTTP/2 Flaw Enables Remote Code Execution
The Apache Software Foundation has patched a critical double-free vulnerability in the HTTP/2 module of the Apache HTTP Server that can be exploited for denial-of-service or remote code execution.
The Apache Software Foundation has released security updates for the Apache HTTP Server to address a critical vulnerability, tracked as CVE-2026-23918, which carries a CVSS score of 8.8. The flaw, identified in the mod_http2 module, allows for both denial-of-service (DoS) attacks and potential remote code execution (RCE) The Hacker News.
The technical root of the issue is a double-free vulnerability located in the stream cleanup path of h2_mplx.c. According to researchers Bartlomiej Dmitruk and Stanislaw Strzalkowski, the bug is triggered when a client sends an HTTP/2 HEADERS frame immediately followed by an RST_STREAM frame with a non-zero error code before the multiplexer has registered the stream. This sequence causes two callbacks—on_frame_recv_cb and on_stream_close_cb—to execute in succession, both calling h2_mplx_c1_client_rst and m_stream_cleanup. Consequently, the same h2_stream pointer is pushed onto the cleanup array twice, leading to a double-free when c1_purge_streams attempts to destroy the stream The Hacker News.
The impact of this vulnerability varies based on the server configuration. A DoS attack is considered trivial to execute, requiring only a single TCP connection and two frames without the need for authentication or specific headers. This can be sustained to repeatedly crash worker processes. The RCE path, however, is more complex and requires the Apache Portable Runtime (APR) to be configured with the mmap allocator, which is the default setting on Debian-based systems and the official Apache httpd Docker image The Hacker News.
To achieve RCE, researchers demonstrated a proof-of-concept on x86_64 architecture that involves placing a fake h2_stream structure at the freed virtual address via mmap reuse. By leveraging Apache’s scoreboard memory—which remains at a fixed address despite Address Space Layout Randomization (ASLR)—an attacker can point a pool cleanup function to system(). While the exploit requires a memory information leak and relies on probabilistic heap spraying, researchers successfully achieved code execution in laboratory conditions The Hacker News.
The vulnerability affects Apache HTTP Server version 2.4.66. Users are urged to upgrade to version 2.4.67 to mitigate the risk. While the MPM prefork configuration is not susceptible to this flaw, the wide adoption of mod_http2 in default production builds makes the attack surface significant The Hacker News.
This discovery highlights the persistent risks associated with complex protocol handling in widely used web server software. As HTTP/2 remains a standard for modern web traffic, vulnerabilities within its implementation modules like mod_http2 continue to be high-value targets for researchers and threat actors alike. Administrators should prioritize patching to ensure the integrity of their server environments.