AIKIDO-2026-10737
httpd is vulnerable to Double Free
91
Critical Risk
This Affects:
httpdTL;DR
A double free vulnerability in Apache HTTP Server when processing HTTP/2 protocol requests can lead to memory corruption due to improper handling of freed memory. This condition may allow an attacker to trigger a crash or manipulate memory structures, potentially resulting in remote code execution (rce) in certain configurations. This issue affects Apache HTTP Server builds with HTTP/2 support enabled. Exploitation typically requires sending specially crafted HTTP/2 requests that cause the server to free the same memory region multiple times.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
httpd is vulnerable to Double Free in versions 2.4.66 - 2.4.66.
How to fix this
Upgrade the httpd/apache library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant