A double-free vulnerability in Apache HTTP Server 2.4.66’s mod_http2 module has been disclosed, enabling denial of service attacks against affected servers.
The bug, CVE-2026-23918 (CWE-415), is a race condition in the stream cleanup path. Researchers Bartlomiej Dmitruk and Stanislaw Strzalkowski found the flaw. By sending HEADERS and RST_STREAM frames rapidly, an attacker can trigger a double-free and crash the worker process.
This isn’t remotely exploitable for code execution — it’s strictly a denial of service issue. But that’s still a problem for production web servers running Apache 2.4.66 with HTTP/2 enabled. A single unauthenticated attacker can take down a worker thread, and repeated requests can degrade service availability.
The proof-of-concept uses the Python h2 library to establish an HTTP/2 connection and spam the server with HEADERS followed by RST_STREAM frames. Servers running Debian or Ubuntu with Apache 2.4.66 are confirmed affected.
Apache users should upgrade to a patched version immediately. If you can’t patch quickly, consider temporary mitigations like rate limiting HTTP/2 connections or disabling mod_http2 until an update can be applied.
