Bug 2465304 (CVE-2026-23918) - CVE-2026-23918 Apache HTTP Server: Apache HTTP Server: Remote Code Execution via Double Free in HTTP/2 Protocol
Summary: CVE-2026-23918 Apache HTTP Server: Apache HTTP Server: Remote Code Execution ...
Keywords:
Status: NEW
Alias: CVE-2026-23918
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2466827
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-04 15:02 UTC by OSIDB Bzimport
Modified: 2026-05-08 13:56 UTC (History)
13 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-05-04 15:02:04 UTC
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.

This issue affects Apache HTTP Server: 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Comment 4 Joe Orton 2026-05-07 06:53:39 UTC
Please note this vulnerability is present in certain versions of mod_http2, and it is fixed in mod_http2 2.0.37 and later.
I'm trying to identify exactly which versions of mod_http2 are vulnerable, we know at least 2.0.35 was - users hit the bug with that version in Fedora (bug 2417958).

Comment 5 Joe Orton 2026-05-07 08:16:22 UTC
Also note that in Fedora (and RHEL), while mod_http2 is bundled in the sources for the httpd component, we don't build this module as part of httpd, it is built independently as the mod_http2 component using the separate upstream releases of mod_http2 from GitHub.

Comment 6 Klaas Weyermann 2026-05-07 14:16:03 UTC
(In reply to Joe Orton from comment #5)
> Also note that in Fedora (and RHEL), while mod_http2 is bundled in the
> sources for the httpd component, we don't build this module as part of
> httpd, it is built independently as the mod_http2 component using the
> separate upstream releases of mod_http2 from GitHub.

so that would mean: https://access.redhat.com/security/cve/cve-2026-23918
is incorrect httpd component/package is not affected, only mod_http2 ?

Comment 7 Joe Orton 2026-05-08 07:01:15 UTC
(In reply to Klaas Demter from comment #6)
> (In reply to Joe Orton from comment #5)
> > Also note that in Fedora (and RHEL), while mod_http2 is bundled in the
> > sources for the httpd component, we don't build this module as part of
> > httpd, it is built independently as the mod_http2 component using the
> > separate upstream releases of mod_http2 from GitHub.
> 
> so that would mean: https://access.redhat.com/security/cve/cve-2026-23918
> is incorrect httpd component/package is not affected, only mod_http2 ?

Correct, I have a request in to Red Hat Product Security to address this. We're working on verifying which versions of mod_http2 are affected by this going back across RHEL versions

Comment 8 Joe Orton 2026-05-08 08:53:14 UTC
We've confirmed that the versions of mod_http2 in RHEL are not vulnerable to this issue.

The tracking information at https://access.redhat.com/security/cve/cve-2026-23918 is incorrectly listing `httpd` as affected here still, but that should get fixed shortly.


Note You need to log in before you can comment on or make changes to this bug.