Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HApache HTTP Server
APPApache2.4.66
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2024-38475CRITICAL9.1⚠ KEVPL ✓ten sam produkt
Apache HTTP Server mod_rewrite — ujawnienie kodu i RCE poprzez błędne escapowanie
CVE-2021-42013CRITICAL9.8⚠ KEVten sam produkt
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could ...
CVE-2021-41773CRITICAL9.8⚠ KEVten sam produkt
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a ...
CVE-2021-40438CRITICAL9.0⚠ KEVten sam produkt
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remot...
CVE-2026-29167CRITICAL9.8PL ✓ten sam produkt
Use-after-free w Apache HTTP Server z mod_ldap (CVE-2026-29167)