Description
Apache httpd 2.4.66 版本的 mod_http2 模块被曝存在双重释放漏洞（CVE-2026-23918，CVSS8.8），攻击者在无需身份验证的情况下，通过构造特定顺序的 HTTP/2 帧，可导致工作进程崩溃；在特定条件下，该漏洞可进一步实现远程代码执行（RCE）。
Apache HTTP/2 双重释放漏洞(CVE-2026-23918)
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2026-23918
https://httpd.apache.org/security/vulnerabilities_24.html
https://thehackernews.com/2026/05/critical-apache-http2-flaw-cve-2026.html
https://zhuanlan.zhihu.com/p/2035768677463761532
https://www.ithome.com.tw/news/175577
https://access.redhat.com/security/cve/cve-2026-23918
https://security.berkeley.edu/news/critical-apache-2466-http2-flaw-allows-rce-dos-cve-2026-23918
https://github.com/rhasan-com/CVE-2026-23918
https://orca.security/resources/blog/apache-http-server-http2-vulnerability-cve-2026-23918/
https://securityaffairs.com/191759/security/apache-fixes-critical-http-2-double-free-flaw-cve-2026-23918-enabling-rce.html