GitHub Exploit Metadata - Exploit Intel

PoC files

20 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-10

Technical assessment

The artifact is a scanner that checks for CVE-2026-23918, a double-free vulnerability in Apache HTTP Server mod_http2. It sends crafted HTTP/2 frames (HEADERS followed by RST_STREAM) to trigger the vulnerable code path and then observes server health via connection probes to detect crashes, explicitly stating it is not an exploit.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of documentation, a PoC trigger script (poc.py), a control test script (control_test.py), and verification artifacts for CVE-2026-23918. All code is plain Python 3 using only the standard library. The PoC sends crafted HTTP/2 frames to trigger a known double-free vulnerability in Apache HTTP Server 2.4.66. No concealed, deceptive, or operator-directed harmful behavior was observed. The scripts perform only the advertised vulnerability demonstration and crash detection, with no unrelated payload, persistence, credential theft, or remote access.

ClassificationScanner

Model confidence95%

AuthenticationNot required

LanguagesPythonMarkdown

Target softwareApache HTTP Server

Attack typesDenial of Service

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact (poc/poc.py) is explicitly described as 'NOT an exploit' and a 'minimal *primitive* check' that 'looks for evidence that a server child process died'. It sends frames to trigger a vulnerability but only observes external behavior (health probes) to detect crashes, which is characteristic of a scanner. It does not attempt to gain code execution or control the target beyond causing a crash.

poc/poc.py:3-11poc/poc.py:250-262

Requirements

Target must have HTTP/2 enabled and be running a threaded MPM (event/worker).README.md:13
Target must be Apache HTTP Server version 2.4.66 (or a backported version without the fix).README.md:13

Observed behavior

Sends HTTP/2 connection preface, SETTINGS frame, and multiple pairs of HEADERS and RST_STREAM frames with a non-zero error code on the same stream.poc/poc.py:151-174
Performs health probes (fresh connections with PING) before and after sending trigger frames to detect server child process crashes.poc/poc.py:136-148poc/poc.py:225-252
Reports 'VULNERABLE-BEHAVIOUR' if post-trigger health probes fail or show significant latency increase, otherwise reports 'NO CRASH OBSERVED'.poc/poc.py:250-262

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Authorization Gate: --i-am-authorized flag required to run poc.pyThe PoC script refuses to run without an explicit authorization flag, preventing accidental execution.poc/poc.py:197-200
Network Behavior: Sends HTTP/2 HEADERS+RST_STREAM frames to target serverThe PoC's only network activity is sending crafted HTTP/2 frames to the specified target to trigger the CVE. No other network connections are made.poc/poc.py:151-174
File System Behavior: No file system writes or modificationsNeither poc.py nor control_test.py contain any file write, delete, or modification operations. They only read from the network and print to stdout.poc/poc.py:1-275poc/control_test.py:1-187
Process Behavior: No subprocess execution or command invocationThe scripts do not invoke any external commands, spawn subprocesses, or execute shell commands.poc/poc.py:1-275poc/control_test.py:1-187

Review boundaries

What the analysis did not establish

Evidence coverage is COMPLETE_FOR_READABLE_SELECTED_TEXT; 14 unclassified files (172769 bytes) are not included, but the selected text files represent the core PoC logic and documentation.
The artifact's own documentation states that a negative result is not proof of safety, as the double free can corrupt silently with the APR mmap allocator.
14 unclassified files totaling 172,769 bytes were present in the repository unit but not included as text evidence; their content was not reviewed.
Binary files were flagged as metadata-only and not analyzed.
The review is limited to the supplied text evidence and does not verify the correctness or safety of the PoC against the target vulnerability.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

CVE-2026-23918/docker-compose.yml

Created 2026-05-19Vuln labCVE-2026-23918Compose · mixed

1 Compose manifest · 2 Dockerfiles · 2 services

Analysisdeepseek-v4-pro:cloud · 2026-08-10

Environment assessment

A two-container Docker Compose lab for CVE-2026-23918, an Apache HTTP Server mod_http2 double-free vulnerability. It consists of a vulnerable target (httpd:2.4.66) and a patched control target (httpd:2.4.67), both with HTTP/2 cleartext (h2c) enabled. The lab includes Python PoC scripts to trigger and verify the vulnerability.

CVE-2026-23918/docker-compose.yml:1-32CVE-2026-23918/README.md:1-107

Lab assessment

Vulnerability lab

The environment is explicitly designed to reproduce and verify CVE-2026-23918, a double-free vulnerability in Apache mod_http2. It includes a vulnerable target, a patched control, and PoC scripts that trigger the vulnerability and check for crashes. The README describes it as a 'lab' with 'Lab Architecture' and 'Quick Start' instructions for exercising the vulnerability.

CVE-2026-23918/README.md:1-107CVE-2026-23918/docker-compose.yml:1-32

Lab shapeCompose · mixed

Services2

Compose manifests1

Dockerfiles2

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

vulnerable

vulnerable targetApache HTTP Server 2.4.66 with mod_http2

A container built from httpd:2.4.66 with mod_http2 loaded and Protocols h2c http/1.1 enabled. It exposes port 80 on host port 8080. It is the target for the PoC trigger to demonstrate the double-free vulnerability.

CVE-2026-23918/docker-compose.yml:3-16CVE-2026-23918/Dockerfile.vulnerable:1-12

patched

patched control targetApache HTTP Server 2.4.67 with mod_http2

A container built from httpd:2.4.67 with identical mod_http2 configuration. It exposes port 80 on host port 8081. It serves as a control to show that the vulnerability is fixed in the patched version.

CVE-2026-23918/docker-compose.yml:19-32CVE-2026-23918/Dockerfile.patched:1-10

poc.py

vulnerability triggercrash detector

A Python script that sends HTTP/2 HEADERS frames immediately followed by RST_STREAM with a non-zero error code to trigger the double-free in the vulnerable server. It then checks for server health degradation (crashes) via fresh connection probes. Requires --i-am-authorized flag.

CVE-2026-23918/poc/poc.py:1-275

control_test.py

control testwell-formed HTTP/2 traffic generator

A Python script that sends well-formed HTTP/2 GET requests and a late RST_STREAM to verify that normal traffic does not trigger the vulnerability. It confirms the server remains healthy on both targets.

CVE-2026-23918/poc/control_test.py:1-187

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-23918

Supported by supplied evidence

The entire lab is built around CVE-2026-23918. The README, Dockerfiles, and PoC scripts explicitly reference this CVE. The vulnerable Dockerfile uses httpd:2.4.66, which the README states is the affected version, and the patched Dockerfile uses 2.4.67, the fixed version. The PoC verification report documents successful triggering of a double-free crash on 2.4.66 and no crash on 2.4.67, consistent with the CVE description.

CVE-2026-23918/README.md:1-107CVE-2026-23918/Dockerfile.vulnerable:1-12CVE-2026-23918/Dockerfile.patched:1-10CVE-2026-23918/poc_verification_report.md:1-86

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker and Docker Compose installed to build and run the containers.CVE-2026-23918/README.md:53-55
Python 3.8+ with standard library only to run the PoC scripts.CVE-2026-23918/poc/poc.py:20
Network access to the host ports 8080 and 8081 from the machine running the PoC.CVE-2026-23918/docker-compose.yml:9-10CVE-2026-23918/docker-compose.yml:25-26

Evidence-described exercise path

Build and start both targets using 'docker compose up -d --build'.CVE-2026-23918/README.md:55
Wait for healthchecks to show both services as healthy.CVE-2026-23918/README.md:58
Run control test on both targets to verify well-formed traffic is handled correctly.CVE-2026-23918/README.md:61-62
Trigger the vulnerability against the vulnerable target using 'python3 poc/poc.py http://127.0.0.1:8080 --i-am-authorized'.CVE-2026-23918/README.md:66
Check server logs for crash evidence (e.g., 'exit signal Segmentation fault').CVE-2026-23918/README.md:69-70
Run the same trigger against the patched target to confirm no crashes occur.CVE-2026-23918/README.md:73-74
Tear down the lab with 'docker compose down -v'.CVE-2026-23918/README.md:77

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The lab is self-contained: two containers that only expose ports 8080 and 8081 to the host for testing. The PoC scripts target these local ports and are designed to crash worker processes inside the vulnerable container, which is the intended demonstration of the vulnerability. There is no evidence of host escape, external network connections, persistence mechanisms, credential theft, or any behavior beyond the documented vulnerability exercise. The containers are not privileged, do not mount sensitive host volumes, and the PoC requires an explicit authorization flag.

CVE-2026-23918/docker-compose.yml:1-32CVE-2026-23918/poc/poc.py:1-275CVE-2026-23918/poc/control_test.py:1-187

Review boundaries

What the analysis did not establish

The packet does not include the full vulnerability analysis (vulnerability_analysis.md) or intel brief (intel_brief.md) files, only their mention in the README.
The packet includes binary artifacts (gdb captures, diff files) that are not inspected, but their content is described in the verification report.
The PoC scripts are not executed; the analysis is based solely on static review of the provided text files.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.