Apache patches a double-free in HTTP/2 that crashes workers with two frames and one TCP connection
Apache HTTP Server 2.4.67 fixes CVE-2026-23918, a double-free in mod_http2 that triggers on early stream reset and may enable remote code execution on Debian-default builds.
4 min read4 sources