CVE-2026-23918

8.8 Élevée

Publiée le 04/05/2026 à 17:16 · Modifiée le 15/07/2026 à 04:18 · Modifiée · Source : security@apache.org

Description

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache HTTP Server
Red Hat Hardened Images
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat JBoss Core Services
Apache http server

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.8 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.1	8.8 Élevée	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-415
CWE-1341

Références

https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/04/19 Mailing ListThird Party Advisory
https://access.redhat.com/errata/RHSA-2026:13938
https://access.redhat.com/security/cve/CVE-2026-23918
https://bugzilla.redhat.com/show_bug.cgi?id=2465304
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23918.json

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories