CVE-2026-48913

HIGH

Apache HTTP Server: mod_http2 memory corruption when file handles exhausted

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-48913 has a selected CVSS score of 7.3 (high); EIP currently links 1 curated repository PoC.

Description

Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 8, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Apache HTTP Server

Browse Apache Software Foundation / Apache HTTP Server

Default status: unaffected

CVE List2.4.55 to ≤ 2.4.67affected

Proofs of concept

1

Curated repository PoCs

GitHubCVE-2026-23918Curated repository PoCby exploitintel8Scanner20 files

C · 200.1 KiB · linked to 2 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a scanner that checks for CVE-2026-23918, a double-free vulnerability in Apache HTTP Server mod_http2. It sends crafted HTTP/2 frames (HEADERS followed by RST_STREAM) to trigger the vulnerable code path and then observes server health via connection probes to detect crashes, explicitly stating it is not an exploit.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of documentation, a PoC trigger script (poc.py), a control test script (control_test.py), and verification artifacts for CVE-2026-23918. All code is plain Python 3 using only the standard library. The PoC sends crafted HTTP/2 frames to trigger a known double-free vulnerability in Apache HTTP Server 2.4.66. No concealed, deceptive, or operator-directed harmful behavior was observed. The scripts perform only the advertised vulnerability demonstration and crash detection, with no unrelated payload, persistence, credential theft, or remote access.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPythonMarkdown
Target softwareApache HTTP Server
Attack typesDenial of Service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact (poc/poc.py) is explicitly described as 'NOT an exploit' and a 'minimal *primitive* check' that 'looks for evidence that a server child process died'. It sends frames to trigger a vulnerability but only observes external behavior (health probes) to detect crashes, which is characteristic of a scanner. It does not attempt to gain code execution or control the target beyond causing a crash.

poc/poc.py:3-11poc/poc.py:250-262

Requirements

  • Target must have HTTP/2 enabled and be running a threaded MPM (event/worker).README.md:13
  • Target must be Apache HTTP Server version 2.4.66 (or a backported version without the fix).README.md:13

Observed behavior

  • Sends HTTP/2 connection preface, SETTINGS frame, and multiple pairs of HEADERS and RST_STREAM frames with a non-zero error code on the same stream.poc/poc.py:151-174
  • Performs health probes (fresh connections with PING) before and after sending trigger frames to detect server child process crashes.poc/poc.py:136-148poc/poc.py:225-252
  • Reports 'VULNERABLE-BEHAVIOUR' if post-trigger health probes fail or show significant latency increase, otherwise reports 'NO CRASH OBSERVED'.poc/poc.py:250-262
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Authorization Gate
Payload withheldThe PoC script refuses to run without an explicit authorization flag, preventing accidental execution.poc/poc.py:197-200
Network Behavior
Payload withheldThe PoC's only network activity is sending crafted HTTP/2 frames to the specified target to trigger the CVE. No other network connections are made.poc/poc.py:151-174
File System Behavior
Payload withheldNeither poc.py nor control_test.py contain any file write, delete, or modification operations. They only read from the network and print to stdout.poc/poc.py:1-275poc/control_test.py:1-187
Process Behavior
Payload withheldThe scripts do not invoke any external commands, spawn subprocesses, or execute shell commands.poc/poc.py:1-275poc/control_test.py:1-187
Review boundaries

What the analysis did not establish

  • Evidence coverage is COMPLETE_FOR_READABLE_SELECTED_TEXT; 14 unclassified files (172769 bytes) are not included, but the selected text files represent the core PoC logic and documentation.
  • The artifact's own documentation states that a negative result is not proof of safety, as the double free can corrupt silently with the APR mmap allocator.
  • 14 unclassified files totaling 172,769 bytes were present in the repository unit but not included as text evidence; their content was not reviewed.
  • Binary files were flagged as metadata-only and not analyzed.
  • The review is limited to the supplied text evidence and does not verify the correctness or safety of the PoC against the target vulnerability.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3