Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Please note this vulnerability is present in certain versions of mod_http2, and it is fixed in mod_http2 2.0.37 and later. I'm trying to identify exactly which versions of mod_http2 are vulnerable, we know at least 2.0.35 was - users hit the bug with that version in Fedora (bug 2417958).
Also note that in Fedora (and RHEL), while mod_http2 is bundled in the sources for the httpd component, we don't build this module as part of httpd, it is built independently as the mod_http2 component using the separate upstream releases of mod_http2 from GitHub.
(In reply to Joe Orton from comment #5) > Also note that in Fedora (and RHEL), while mod_http2 is bundled in the > sources for the httpd component, we don't build this module as part of > httpd, it is built independently as the mod_http2 component using the > separate upstream releases of mod_http2 from GitHub. so that would mean: https://access.redhat.com/security/cve/cve-2026-23918 is incorrect httpd component/package is not affected, only mod_http2 ?
(In reply to Klaas Demter from comment #6) > (In reply to Joe Orton from comment #5) > > Also note that in Fedora (and RHEL), while mod_http2 is bundled in the > > sources for the httpd component, we don't build this module as part of > > httpd, it is built independently as the mod_http2 component using the > > separate upstream releases of mod_http2 from GitHub. > > so that would mean: https://access.redhat.com/security/cve/cve-2026-23918 > is incorrect httpd component/package is not affected, only mod_http2 ? Correct, I have a request in to Red Hat Product Security to address this. We're working on verifying which versions of mod_http2 are affected by this going back across RHEL versions
We've confirmed that the versions of mod_http2 in RHEL are not vulnerable to this issue. The tracking information at https://access.redhat.com/security/cve/cve-2026-23918 is incorrectly listing `httpd` as affected here still, but that should get fixed shortly.