Apache 2.4.x < 2.4.67 Multiple Vulnerabilities

Tenable plugin 311940 bundles 11 CVEs fixed in Apache HTTP Server 2.4.67. The headline driver is CVE-2026-23918, a double-free in mod_http2 that can be chained to remote code execution via heap spray and mmap reuse. However, this RCE *only affects version 2.4.66* — not the broader 2.4.x line. The remaining 10 CVEs range from moderate privilege-escalation in mod_rewrite (CVE-2026-24072) and a timing attack on mod_auth_digest (CVE-2026-33006) down to eight low-severity issues in mod_proxy_ajp, mod_dav_lock, mod_authn_socache, mod_md, and response-splitting fixes. Affected ranges span 2.4.0–2.4.66 for most issues, but the only RCE is pinned to the single 2.4.66 release.

The Tenable plugin reports a CVSS v2 base of 10.0 and a CVSS v3.1 base of 8.8. The eye-catching CRITICAL label comes from the legacy v2 metric, which scores any unauthenticated network-vector RCE at 10.0 regardless of complexity. Apache's own advisory rates CVE-2026-23918 as *important* (one tier below critical), and the v3 score of 8.8 is closer to reality. The VPR score of 7.7 (99th percentile) reflects the PoC existence but not wild exploitation. Treating this bundle as CRITICAL overstates the risk for the vast majority of Apache operators who are not running the single affected version 2.4.66, and even for those who are, the RCE chain requires non-trivial heap manipulation that has only been demonstrated in laboratory conditions.

Why this verdict

• Version scoping slashes the blast radius. CVE-2026-23918 is the only RCE in this bundle and it exclusively affects 2.4.66. Organizations running 2.4.65 or earlier, or already on 2.4.67+, are not vulnerable to the RCE chain. This is not a decade-spanning Apache flaw — it is a single-release regression.
• CVSS v2 inflation drives the CRITICAL label. The 10.0 CVSS v2 score is a legacy artifact — v2 scores any unauthenticated network RCE at 10.0 regardless of attack complexity. The v3.1 score of 8.8 and Apache's own *important* rating are more calibrated. Tenable's VPR of 7.7 confirms HIGH, not CRITICAL.
• RCE chain has real friction. Exploitation requires mmap allocator (not universal across distros), a separate info leak or brute-force for ASLR bypass, and heap spray under non-deterministic production traffic. Lab PoC works in minutes; production exploitation is materially harder.
• No wild exploitation or KEV listing. Four months post-disclosure, no threat actor has weaponized this. EPSS is below 1%. The attack surface exists but adversaries have not prioritized it.
• Role multiplier: Apache is canonically internet-facing, establishing a HIGH floor. Apache httpd is deployed as a web server and reverse proxy at the network edge. Successful RCE grants a foothold on the web tier, which in many architectures has access to application secrets, database credentials, and backend services. This is a high-value role representing a large share of the installed base. The floor for an unauthenticated RCE on an internet-facing component is HIGH. However, the single-version scope (2.4.66 only) and lack of exploitation evidence prevent escalation to CRITICAL — the floor is met but not exceeded.

Why not higher?

CRITICAL would require either active exploitation, KEV listing, or a broader affected version range. CVE-2026-23918 hits only Apache 2.4.66, a single release that was current for roughly 5 months. The RCE chain requires non-trivial heap manipulation with no public weaponized exploit, and no threat actor has demonstrated wild exploitation in the 4+ months since disclosure. The other 10 CVEs in the bundle are moderate-to-low severity and do not move the needle.

Why not lower?

Apache httpd is a canonical network-edge component where RCE means an attacker foothold inside your perimeter. A working lab PoC exists demonstrating the full chain to code execution, and the double-free trigger (DoS) is trivial for anyone running 2.4.66 with HTTP/2. The HIGH floor for unauthenticated RCE on internet-facing infrastructure cannot be broken by friction alone without evidence that <1% of the installed base is reachable.

1. Disable mod_http2 on Apache 2.4.66 instances — Run a2dismod http2 (Debian/Ubuntu) or comment out LoadModule http2_module in httpd.conf. This eliminates the CVE-2026-23918 RCE/DoS attack surface entirely while preserving HTTP/1.1 service. Deploy within 30 days per the noisgate mitigation SLA for HIGH severity. Performance impact is minimal for most workloads.
2. Place a WAF or reverse proxy upstream that terminates HTTP/2 — Cloudflare, AWS ALB, or nginx as an HTTP/2-terminating reverse proxy shields the origin Apache from malformed HTTP/2 frame sequences. The backend connection uses HTTP/1.1, bypassing the vulnerable code path. This is already in place for many production deployments.
3. Enable SELinux/AppArmor httpd confinement — Ensure the Apache process runs under a restrictive mandatory access control profile. This limits post-exploitation pivot even if the double-free is successfully weaponized — the attacker cannot exec arbitrary binaries or access files outside the web root. Verify with aa-status or getenforce.
4. Restrict outbound network from web tier — Firewall rules preventing Apache servers from initiating outbound connections (except to defined backends) limit post-exploitation lateral movement and C2 communication. Deploy as a compensating control within 30 days.

Run this script on each Apache host as any user with read access to the httpd binary. Usage: bash check_apache_311940.sh or bash check_apache_311940.sh /usr/sbin/httpd. No root required unless the binary path is restricted.

#!/bin/bash\n# check_apache_311940.sh — Verify Apache is patched for Tenable plugin 311940\n# Checks for Apache >= 2.4.67 (fixes 11 CVEs including CVE-2026-23918 RCE)\n# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN\n\nset -euo pipefail\n\n# Find httpd binary\nHTTPD=\"${1:-}\"\nif [ -z \"$HTTPD\" ]; then\n  for candidate in /usr/sbin/httpd /usr/sbin/apache2 /usr/local/apache2/bin/httpd /opt/apache/bin/httpd; do\n    if [ -x \"$candidate\" ]; then\n      HTTPD=\"$candidate\"\n      break\n    fi\n  done\nfi\n\nif [ -z \"$HTTPD\" ] || [ ! -x \"$HTTPD\" ]; then\n  echo \"UNKNOWN — Apache httpd binary not found. Specify path as argument.\"\n  exit 2\nfi\n\n# Extract version\nVERSION_OUTPUT=$(\"$HTTPD\" -v 2>/dev/null) || {\n  echo \"UNKNOWN — Could not execute $HTTPD -v\"\n  exit 2\n}\n\nVERSION=$(echo \"$VERSION_OUTPUT\" | grep -oP 'Apache/\\K[0-9]+\\.[0-9]+\\.[0-9]+' | head -1)\n\nif [ -z \"$VERSION\" ]; then\n  echo \"UNKNOWN — Could not parse version from: $VERSION_OUTPUT\"\n  exit 2\nfi\n\necho \"Detected Apache version: $VERSION\"\n\n# Parse major.minor.patch\nIFS='.' read -r MAJOR MINOR PATCH <<< \"$VERSION\"\n\n# Check if >= 2.4.67\nif [ \"$MAJOR\" -gt 2 ] || \\\n   ([ \"$MAJOR\" -eq 2 ] && [ \"$MINOR\" -gt 4 ]) || \\\n   ([ \"$MAJOR\" -eq 2 ] && [ \"$MINOR\" -eq 4 ] && [ \"$PATCH\" -ge 67 ]); then\n  echo \"PATCHED — Apache $VERSION >= 2.4.67. Plugin 311940 CVEs are fixed.\"\n  exit 0\nelse\n  echo \"VULNERABLE — Apache $VERSION < 2.4.67. Affected by 11 CVEs (including CVE-2026-23918 RCE).\"\n  # Extra check: is this exactly 2.4.66 (RCE-vulnerable)?\n  if [ \"$MAJOR\" -eq 2 ] && [ \"$MINOR\" -eq 4 ] && [ \"$PATCH\" -eq 66 ]; then\n    echo \"WARNING — Version 2.4.66 is specifically vulnerable to CVE-2026-23918 (HTTP/2 double-free RCE).\"\n    # Check if mod_http2 is loaded\n    if \"$HTTPD\" -M 2>/dev/null | grep -q http2; then\n      echo \"CRITICAL — mod_http2 is loaded. RCE attack surface is active.\"\n    else\n      echo \"MITIGATED — mod_http2 is not loaded. RCE vector is disabled (other CVEs still apply).\"\n    fi\n  fi\n  exit 1\nfi

Sources

1. Tenable Plugin 311940
2. Apache HTTP Server 2.4 Vulnerabilities
3. Hadrian.io — CVE-2026-23918 HTTP/2 Double-Free RCE Explained
4. The Hacker News — Critical Apache HTTP/2 Flaw
5. HKCERT — Apache HTTP Server Multiple Vulnerabilities
6. webhosting.today — Apache 2.4.67 Patches 11 CVEs
7. CVE Record — CVE-2026-23918
8. Red Hat — CVE-2026-23918