CVE-2026-23918 is a double-free vulnerability in Apache httpd 2.4.66 mod_http2, specifically in the stream cleanup path of h2_mplx.c. The bug triggers when a client sends an HTTP/2 HEADERS frame immediately followed by RST_STREAM with a non-zero error code on the same stream, before the multiplexer has registered the stream. Two nghttp2 callbacks fire in sequence, causing the same h2_stream pointer to be pushed onto the spurge cleanup array twice. When c1_purge_streams iterates and calls h2_stream_destroy on each entry, the second call hits already freed memory. The RCE path requires APR with mmap allocator and uses Apache's scoreboard memory as a stable container for fake structures.