Apache Protocol Parsers Expose Servers to RCE and DoS
Apache’s latest fixes point to a recurring problem: protocol handlers are turning routine parsing mistakes into code execution and denial of service. The standard response is to treat this as a patch-only event, but the bigger issue is that HTTP/2 and AJP are exposed attack surfaces that can fail hard before any application logic is reached.
Apache HTTP Server 2.4.67 fixes 11 flaws, including CVE-2026-23918, an HTTP/2 double-free that can lead to DoS and possible RCE, and CVE-2026-28780, an AJP heap buffer overflow that can let remote attackers trigger DoS and execute code. The release also closes multiple DoS and information disclosure bugs, plus response manipulation and Digest authentication bypass issues. Apache MINA 2.2.7 and 2.1.12 fix two critical flaws, CVE-2026-42778 and CVE-2026-42779, both tied to incomplete prior fixes that can still lead to code execution.
Protocol parsing bugs in widely deployed server components keep producing high-severity failures because they sit in front of everything else. That makes Apache’s handler layer a recurring source of critical exposure, not a one-off defect class.