VULNERABILITY•MAY 14, 2026
CVE-2026-23918: Tearing Down the Apache mod_http2 Early-Reset Double-Free
A race between HTTP/2 HEADERS and RST_STREAM frames lets unauthenticated clients double-free a stream pool inside mod_http2's h2_mplx.c. We dissect the bug, the patch in 2.4.67, and what defenders should actually do.