gagaltotal/CVE-2026-23918-Double-free-Apache-httpd-mod_http2

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Go-based proof-of-concept exploit for CVE-2026-23918, a double-free vulnerability in Apache httpd mod_http2. The code implements a spray-and-trigger approach: it crafts HTTP/1.1 requests to spray memory with a payload containing a command and the address of the system() function, then sends HTTP/2 RST_STREAM frames to trigger the double-free and redirect execution to the injected command.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Go source file implementing a proof-of-concept exploit for CVE-2026-23918. The code performs memory spray and HTTP/2 trigger operations against a target Apache httpd server to achieve remote code execution, which is the stated purpose of the PoC. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm beyond the declared exploit behavior was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesGo
Target softwareApache HTTP Servermod_http2
Attack typesRemote Code ExecutionMemory CorruptionDouble Free
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code is designed to exercise a vulnerability by sending crafted network payloads to a target to achieve remote code execution. It includes memory spray, address manipulation, and a trigger sequence, which are characteristic of an exploit. The README explicitly describes it as a 'proof-of-concept exploit' and the code attempts to execute a user-supplied command on the target.

README.md:3README.md:7-12exploit_poc.go:332-365exploit_poc.go:711-731

Requirements

  • Target must be running a vulnerable version of Apache httpd with mod_http2 (CVE-2026-23918).README.md:1-3
  • Network access to the target Apache httpd instance.README.md:29
  • Root privileges on the attacker machine if using automatic memory address extraction via /proc/<pid>/mem.README.md:28
  • Knowledge of the target Apache worker process PID (for auto mode) or the addresses of system() and the scoreboard request slot (for manual mode).README.md:57-78

Observed behavior

  • Extracts memory addresses of system() and the Apache scoreboard from a target process using /proc/<pid>/mem and nm.exploit_poc.go:72-284
  • Builds a crafted HTTP/1.1 request payload containing a shell command and memory addresses to overwrite the scoreboard and redirect execution.exploit_poc.go:332-397
  • Performs a memory spray by repeatedly sending the crafted HTTP/1.1 requests over TLS to the target.exploit_poc.go:428-462
  • Sends HTTP/2 RST_STREAM frames to trigger the double-free vulnerability and achieve code execution.exploit_poc.go:711-731
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Memory spray and HTTP/2 trigger sequence targeting Apache httpd mod_http2The code constructs crafted HTTP requests, performs memory spray via TLS connections, and sends HTTP/2 frames to trigger a double-free vulnerability, consistent with the described CVE-2026-23918 exploit.exploit_poc.go:332-397exploit_poc.go:428-462exploit_poc.go:711-731
Command Execution
User-supplied command executed via system() addressThe exploit accepts a --cmd flag and embeds the command into the spray payload, aiming to redirect execution to the system() function. This is the intended RCE mechanism of the PoC.exploit_poc.go:300-301exploit_poc.go:336-337exploit_poc.go:357-359
Memory Extraction
Reads /proc/<pid>/mem and parses /proc/<pid>/maps to locate system and scoreboard addressesThe auto-extract mode uses OS-level process memory access to find required addresses, which is a standard technique for local privilege escalation or exploit development and is documented in the README.exploit_poc.go:72-95exploit_poc.go:124-167exploit_poc.go:245-284
Review boundaries

What the analysis did not establish

  • The evidence includes only the README.md and exploit_poc.go files; three other files (go.mod, exploit, images) are not provided as text, so the complete build environment and any supporting assets are not fully visible.
  • The code is not executed or verified; classification is based solely on static analysis of the provided source code and documentation.
  • Two non-text media files (images) and one unclassified file (280 bytes) were present but not analyzed; their content could not be reviewed.
  • The precompiled 'exploit' binary was not inspected; only the source code was reviewed.
  • The review is limited to the supplied text evidence and does not verify runtime behavior or network traffic.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1