Apache HTTP Server HTTP/2 double free (CVE-2026-23918)

Oct 14, 2026

An HTTP/2 memory management flaw may cause a crash or remote code execution.

Vulnerability ID	Vulnerability Overview
CVE-2026-23918	A double-free error in the HTTP/2 implementation can corrupt server memory. Successful exploitation may allow remote code execution; exploitability depends on the affected build and request handling.

Affected Supported TeraStations

TS5020 / TS3030
- Fixed in firmware version 3.16

Date	Description
10/14/2026	Initial release