CVE-2026-23918

Fix

Public exploits 16

• Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service (webapps · multiple) Exploit-DB · 2026-05-26
• 12lie20/CVE-2026-23918-test PoC on GitHub
• Bencodin/CVE-2026-23918-poc PoC on GitHub
• CYFARE/CVE-2026-23918-Apache-HTTP-Server-DoubleFree-PoC PoC on GitHub
• aa022/CVE-2026-23918-Passive-Audit PoC on GitHub
• alt3kx/CVE-2026-23918 PoC on GitHub
• gagaltotal/CVE-2026-23918-Double-free-Apache-httpd-mod_http2 PoC on GitHub
• hackervlogofficial/CVE-2026-23918 PoC on GitHub
• insomnisec/Detections-CVE-2026-23918 PoC on GitHub
• qassam-315/CVE-2026-23918-Elite-Auditor PoC on GitHub
• rhasan-com/CVE-2026-23918 PoC on GitHub
• rshosting/Apache-CVE-2026-23918-fix PoC on GitHub
• seguridadentrerios/CVE-2026-23918 PoC on GitHub
• sibersan/apache_audit_cve-2026-23918 PoC on GitHub
• striga-ai/CVE-2026-23918 PoC on GitHub
• xeloxa/CVE-2026-23918-Apache-H2-PoC PoC on GitHub

Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.

Patch, vendor advisory and mitigation references on NVD 1

• https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.