Apache fixes critical HTTP/2 double-free flaw CVE-2026-23918 enabling RCE

May 6, 2026 Yanac

Apache fixed several flaws in HTTP Server, including CVE-2026-23918 (CVSS score of 8.8), a double-free bug in HTTP/2 that could allow remote code execution. The Apache Software Foundation has released updates to fix multiple vulnerabilities in its HTTP Server, including CVE-2026-23918 (CVSS score of 8.8). The issue involves a “double free” error in HTTP/2 handlingSecurity AffairsRead More