Red Hat issued a security advisory (RHSA-2026:13938) for Red Hat Hardened Images RPMs, including Apache HTTP Server packages updated to version 2.4.67-0.1.hum1. The advisory addresses multiple CVEs, notably CVE-2026-23918, a double free vulnerability in the HTTP/2 protocol implementation of Apache HTTP Server. This vulnerability allows remote attackers to potentially execute arbitrary code by triggering a double free condition during early HTTP/2 stream resets, which can corrupt heap allocator metadata. The flaw is exploitable pre-authentication via network input. The advisory recommends disabling the mod_http2 module to mitigate risk. The update includes various httpd-related RPMs for aarch64 and x86_64 architectures. No explicit patch availability is confirmed in the advisory text, and no known exploits in the wild are reported.

Successful exploitation of CVE-2026-23918 could lead to remote code execution, resulting in complete compromise of affected systems running Apache HTTP Server with HTTP/2 enabled. The vulnerability is a memory safety violation (double free) that can corrupt heap metadata, enabling attackers to manipulate memory layout. Given Apache HTTP Server's widespread deployment in internet-facing environments, this elevates the risk significantly. Other CVEs included in the advisory may have additional impacts but are not detailed here.

Red Hat advises disabling the mod_http2 module in Apache HTTP Server configuration by commenting out or removing the 'LoadModule http2_module modules/mod_http2.so' line in the Apache configuration files and restarting the httpd service. This mitigation disables HTTP/2 functionality, which may impact services relying on it. The advisory does not explicitly confirm a released patch; users should monitor Red Hat's official channels for updates and apply the recommended update RPMs when available. Since this is not a cloud service, remediation depends on user action.