The Apache HTTP Server project has released a corrective update httpd 2.4.67, which addresses a vulnerability CVE-2026-23918 in the HTTP/2 implementation. The issue has been rated as important and is related to a class of error known as double free that occurs when handling an early connection reset scenario in HTTP/2. Under unfavorable conditions, this error may lead not only to a crash of the worker process but also to potential remote code execution.
According to the Apache description, the vulnerability affects Apache HTTP Server 2.4.66. Users of this version are advised to upgrade to 2.4.67, where the issue has been resolved. The vulnerability was discovered by Bartlomiej Dmitruk from striga.ai and Stanislaw Strzalkowski from isec.pl.
The changelog of the release also notes an update to mod_http2 to version 2.0.37, which prevents repeated stream purging that led to the double free issue, as well as updates to 2.0.38 and 2.0.39. In addition to CVE-2026-23918, the release addresses several other security issues in mod_proxy_ajp, mod_auth_digest, mod_authn_socache, mod_md, mod_rewrite, and other components.
Release Apache httpd 2.4.67 was published on May 4, 2026, and is declared the current recommended version of the stable 2.4.x branch. For administrators using Apache with HTTP/2 enabled, updating should be considered a priority, especially if 2.4.66 is already in production.
Source: linux.org.ru
