Bug 2467275

Summary:	Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE
Product:	[Fedora] Fedora	Reporter:	customercare
Component:	httpd	Assignee:	Luboš Uhliarik <luhliari>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	urgent	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	anon.amish, jorton, luhliari, mturk
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	Unspecified
OS:	Linux
URL:	https://thehackernews.com/2026/05/critical-apache-http2-flaw-cve-2026.html
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-05-08 16:15:35 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description customercare 2026-05-06 16:14:11 UTC

No Builds in bodhi atm!

The vulnerability, tracked as CVE-2026-23918 (CVSS score: 8.8), has been described as a case of "double free and possible RCE" in the HTTP/2 protocol handling. This issue affects Apache HTTP Server 2.4.66 and has been addressed in version 2.4.67.



Reproducible: Always

Comment 1 Joe Orton 2026-05-08 16:15:35 UTC

See bug 2465304