Critical apache CVE-2026-23918 - AIO impacted?

🏷️ General
,
1

I have no support/technical question and have seen the support category. (Be aware that direct support questions will be deleted.)

on

Which general topic do you have

Hi everyone,

I came across a recent security advisory regarding Apache HTTP Server and wanted to check whether Nextcloud All-in-One setups might be impacted.

Apache version 2.4.67 (released May 4, 2026) fixes several vulnerabilities, including a critical issue (CVE-2026-23918, CVSS 8.8) affecting the HTTP/2 implementation. The bug is a double-free memory corruption triggered during an early stream reset in HTTP/2, which can potentially lead to remote code execution. This specifically affects version 2.4.66

Given that Nextcloud All-in-One uses Apache with this exact version and has HTTP/2 support enabled by default in AIO, I’m wondering

  • is AIO impcated?
  • if yes, when will be the update be released?

Would appreciate any clarification from maintainers or anyone who has looked into this.

Thanks!

2

Hey, I just checked this and Apache is not handling h2 in our case as we have a Caddy-server instance in front of Apache that handles the certs and h2 and h3. Also the h2 Apache module is not even enabled.

So the CVE is not applicable in the case of AIO.

4

Hi!

Thank you very much for the checking and clarification!

5

Just FYI: Apache was just updated within AIO to v2.4.67 and is now released with AIO v13.0.2 Beta. Testing and feedback is welcome! See https://github.com/nextcloud/all-in-one#how-to-switch-the-channel

6

But what about the non-AIO-Image (docker.io/nextcloud:33)?

7

By the way, Ubuntu users with bare-metal installations will not be offered the new version. Anyone who wants to receive the latest security patches immediately—which is, of course, highly recommended for obvious reasons—should use Ondřej Surý’s PPA for Apache2.

The new version was available online the very next day (May 5).

Here is how to add that ppa to your system:

sudo LC_ALL=C.UTF-8 add-apt-repository ppa:ondrej/apache2
sudo apt update

h.t.h.

ernolf

8

Ubuntu 26.04 received a fix. All other Ubuntu releases are not affected because they use older versions of Apache, and CVE-2026-23918 only affects version 2.4.66 specifically.

See here: CVE-2026-23918 | Ubuntu.

…and here: Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project

But yeah, I’m using the PPA as well, and the fix was made available quickly. :slight_smile:

9

So, if I understood it correctly:

10

Yes.

I’m not sure about the Apache Docker image, though. Perhaps you could “docker exec” into the container to check which version is running. As far as I know, the Apache image is Debian-based. Here a link to the Debian Security Tracker for reference: CVE-2026-23918.

11

Most of the time these are backported by the distro…

12

Yes, on Ubuntu, software is usually never updated to new upstream versions within the lifetime of a release; instead, security fixes are backported to the current version.

That’s why the apache2 package still carries the version number 2.4.66 on Ubuntu 26.04, even though it received the fix. Those changes are reflected with an additional “ubuntu” version number attached to the upstream version:

Release version: 2.4.66-2ubuntu2
Fixed Version: 2.4.66-2ubuntu2.1

See also:

13

Yes, I made podman exec ... and apache -V tells me: Apache/2.4.66 (Debian)

14

What does apt policy apache2 say?

In a Debian 13 LXC of mine (without third party repos) it looks like this:

apache2:
  Installed: 2.4.67-1~deb13u2
  Candidate: 2.4.67-1~deb13u2
  Version table:
 *** 2.4.67-1~deb13u2 500
        500 http://security.debian.org trixie-security/main amd64 Packages
        100 /var/lib/dpkg/status
     2.4.66-1~deb13u2 500
        500 http://deb.debian.org/debian trixie/main amd64 Packages

And apache2 -v says:

Server version: Apache/2.4.67 (Debian)
Server built:   2026-05-06T09:07:41

So your version might still be vulnerable. I don’t have any experience with the Nextcloud Docker images, but perhaps you could update it in place via the following command until a new container image is released:

apt update && apt --only-upgrade install apache2

However, before doing that, you could check whether the HTTP2 module is enabled. If not, this particular flaw cannot be exploited.

There are other CVEs in that version that have been fixed, but as far as I know, they are not quite as critical.

So I’d say, it mainly depends on whether your Nextcloud is exposed to the internet. If not, I probably wouldn’t take any action and would wait for a new container image with the updated package. However, I’m not a security expert, so take this advice with a pinch of salt. :wink:

15

Indeed, the http2 module is not enabled. Thanks for the hint!