AIKIDO-2026-10737
httpd is vulnerable to Double Free
91
Critical Risk
This Affects:
httpdTL;DR
A double free vulnerability in Apache HTTP Server when processing HTTP/2 protocol requests can lead to memory corruption due to improper handling of freed memory. This condition may allow an attacker to trigger a crash or manipulate memory structures, potentially resulting in remote code execution (rce) in certain configurations. This issue affects Apache HTTP Server builds with HTTP/2 support enabled. Exploitation typically requires sending specially crafted HTTP/2 requests that cause the server to free the same memory region multiple times.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
httpd is vulnerable to Double Free in versions 2.4.66 - 2.4.66.
How to fix this
Upgrade the httpd/apache library to the patch version.
Links
httpd.apache.org/security/vulnerabilities_24.htmlopenwall.com/lists/oss-security/2026/05/04/19access.redhat.com/errata/RHSA-2026:13938access.redhat.com/security/cve/CVE-2026-23918bugzilla.redhat.com/show_bug.cgi?id=2465304security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23918.json
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.