tag
HTTP/2
CVE-2026-23918
web
CRITICAL
EPSS 50%
Apache httpd mod_http2 Double-Free Pre-Auth RCE - CVE-2026-23918
CVE-2026-23918 is a pre-authentication double-free vulnerability in Apache httpd's modhttp2 stream cleanup path. Under affected configurations, a remote attacker can trigger memory corruption over HTTP/2 before authentication. The upstream PoC demonstrates…
Patched
2026-05-17