I guess we need a new httpd :/

[sysdev]

oss-security - CVE-2026-23918: Apache HTTP Server: http2: double free and possible RCE on early reset

 

[exlhost]

Just released in the new DA version if needed you can already install it via custom versions.

 

[fln]

@sysdev, this is nothing urgent, DA comes with a patch for the double free bug in http2 library (CVE-2026-23918) since DirectAdmin version 1.692. So Apache 2.4.66 built with CustomBuild has this issue fixed already (custombuild/patches/apache/apache-2.4.66-bug-69899-mod_http2-update-to-version-2.0.37.patch).

However Apache 2.4.67 fixes more problems, so we pushed out a new release anyway (for CVE-2026-24072).

 

[sysdev]

@sysdev, this is nothing urgent, DA comes with a patch for the double free bug in http2 library (CVE-2026-23918) since DirectAdmin version 1.692. So Apache 2.4.66 built with CustomBuild has this issue fixed already (custombuild/patches/apache/apache-2.4.66-bug-69899-mod_http2-update-to-version-2.0.37.patch).

However Apache 2.4.67 fixes more problems, so we pushed out a new release anyway (for CVE-2026-24072).

Great! I didn't see the update on the alpha channel. Is that even used actually? I kinda have a test server hanging around for new versions, but it never notifies me of updates.