Serious Apache Web Server Bug Patched

There is a serious vulnerability in the hugely popular Apache web server that can lead to remote code execution in some scenarios. 

The vulnerability (CVE-2026-23918) only affects version 2.4.66 and the Apache Software Foundation has released a fix for the bug in version 2.4.67. The issue is a double free bug in the web server and is only present under specific circumstances. 

“Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue,” the advisory says. 

The Apache HTTP Server is by far the most widely used web server on the internet and is a favorite target of attackers for that reason. Thankfully, this vulnerability, as serious as it is, only exists in version 2.4.66 and the patch is already available. 

But site owners aren’t always eager to take their web servers offline to update them, so there will likely be plenty of vulnerable targets available for attackers. 

Apache also released fixes for two less serious bugs: CVE-2026-24072 and CVE-2026-28780. The former is a medium severity privilege escalation flaw that affects Apache HTTP Server through version 2.4.66, and the latter bug is a low severity buffer overflow vulnerability. 

“If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer,” the advisory for CVE-2026-28780 says.

Version 2.4.67 of the Apache HTTP Server is available and users should upgrade as soon as possible now that details of the flaws are public.