Critical Apache HTTP/2 flaw enables RCE. Patch is 2.4.67.

CVE-2026-23918 is a double-free in Apache HTTP Server's HTTP/2 implementation. RCE is plausible. Upgrade to 2.4.67 or disable HTTP/2 until you can.