Bug 2465304 (CVE-2026-23918)

Summary:	CVE-2026-23918 Apache HTTP Server: Apache HTTP Server: Remote Code Execution via Double Free in HTTP/2 Protocol
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	csutherl, dowdle, jclere, jorton, klaas, pbrobinson, pjindal, plodge, rhel-process-autobot, szappis, vchlup, villapla, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Apache HTTP Server. This vulnerability, related to a double free error within the HTTP/2 protocol implementation, could potentially allow a remote attacker to execute arbitrary code. Successful exploitation could lead to a complete compromise of the affected system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2466827
Bug Blocks:

Description OSIDB Bzimport 2026-05-04 15:02:04 UTC

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.

This issue affects Apache HTTP Server: 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Comment 4 Joe Orton 2026-05-07 06:53:39 UTC

Please note this vulnerability is present in certain versions of mod_http2, and it is fixed in mod_http2 2.0.37 and later.
I'm trying to identify exactly which versions of mod_http2 are vulnerable, we know at least 2.0.35 was - users hit the bug with that version in Fedora (bug 2417958).

Comment 5 Joe Orton 2026-05-07 08:16:22 UTC

Also note that in Fedora (and RHEL), while mod_http2 is bundled in the sources for the httpd component, we don't build this module as part of httpd, it is built independently as the mod_http2 component using the separate upstream releases of mod_http2 from GitHub.

Comment 6 Klaas Weyermann 2026-05-07 14:16:03 UTC

(In reply to Joe Orton from comment #5)
> Also note that in Fedora (and RHEL), while mod_http2 is bundled in the
> sources for the httpd component, we don't build this module as part of
> httpd, it is built independently as the mod_http2 component using the
> separate upstream releases of mod_http2 from GitHub.

so that would mean: https://access.redhat.com/security/cve/cve-2026-23918
is incorrect httpd component/package is not affected, only mod_http2 ?

Comment 7 Joe Orton 2026-05-08 07:01:15 UTC

(In reply to Klaas Demter from comment #6)
> (In reply to Joe Orton from comment #5)
> > Also note that in Fedora (and RHEL), while mod_http2 is bundled in the
> > sources for the httpd component, we don't build this module as part of
> > httpd, it is built independently as the mod_http2 component using the
> > separate upstream releases of mod_http2 from GitHub.
> 
> so that would mean: https://access.redhat.com/security/cve/cve-2026-23918
> is incorrect httpd component/package is not affected, only mod_http2 ?

Correct, I have a request in to Red Hat Product Security to address this. We're working on verifying which versions of mod_http2 are affected by this going back across RHEL versions

Comment 8 Joe Orton 2026-05-08 08:53:14 UTC

We've confirmed that the versions of mod_http2 in RHEL are not vulnerable to this issue.

The tracking information at https://access.redhat.com/security/cve/cve-2026-23918 is incorrectly listing `httpd` as affected here still, but that should get fixed shortly.