CVE-2026-23918

High · CVSS 8.8

Apache HTTP Server — Double Free RCE via HTTP/2 protocol

CVSS: 8.8; nvd
EPSS: —
KEV: No
Class: other; CWE-415, CWE-1341

Description

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Search profile — drives PoC discovery

Symbols mod_http2h2_sessionh2_streamnghttp2double_freeHTTP/2ap_http2h2_connh2_task

Keywords CVE-2026-23918Apache HTTP ServerhttpdHTTP/2double freeRCECWE-415CWE-13412.4.662.4.67mod_http2Apache httpd PoCApache HTTP/2 double free exploit

Versions: 2.4.66

Ranked PoCs (15) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

striga-ai/CVE-2026-23918 candidate

containerized · recent activity

gh_search · Python

★ 29
rhasan-com/CVE-2026-23918 candidate

containerized · recent activity

gh_search · Python

★ 7
aa022/CVE-2026-23918-Passive-Audit needs review

recent activity

gh_search · Python

★ 0
gagaltotal/CVE-2026-23918-Double-free-Apache-httpd-mod_http2 needs review

recent activity

gh_search · Go

★ 0
xeloxa/CVE-2026-23918-Apache-H2-PoC needs review

recent activity

gh_search · Python

★ 20
qassam-315/CVE-2026-23918-Elite-Auditor needs review

recent activity

gh_search · Python

★ 6
12lie20/CVE-2026-23918-test needs review

recent activity

gh_search · Python

★ 4
alt3kx/CVE-2026-23918 needs review

recent activity

gh_search · Python

★ 1
Bencodin/CVE-2026-23918-poc needs review

recent activity

gh_search · Python

★ 0
CYFARE/CVE-2026-23918-Apache-HTTP-Server-DoubleFree-PoC needs review

recent activity

gh_search · Python

★ 0
hackervlogofficial/CVE-2026-23918 needs review

recent activity

gh_search · Python

★ 0
insomnisec/Detections-CVE-2026-23918 needs review

recent activity

gh_search

★ 0
rshosting/Apache-CVE-2026-23918-fix needs review

recent activity

gh_search · Shell

★ 0
seguridadentrerios/CVE-2026-23918 needs review

recent activity

gh_search · Shell

★ 0
sibersan/apache_audit_cve-2026-23918 needs review

recent activity

gh_search · Python

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-06-30T18:30:14.000Z