12lie20/cve-2026-23918-testThis repository contains a Proof of Concept (PoC) demonstrating the Double Free vulnerability (CVE-2026-23918) in Apache HTTP Server 2.4.66 `mod_http2`.
This repository contains a Proof of Concept (PoC) demonstrating the Double Free vulnerability (CVE-2026-23918) in Apache HTTP Server 2.4.66 mod_http2.
The vulnerability stems from a race condition during early RST_STREAM frame processing. I focused on the timing window where the session handler and backend worker both attempt to purge the stream's memory pool, leading to a double free in the APR allocator.
Current Progress Crash Triggered: Successfully hit the race condition locally. The Apache child process terminates with a Segmentation fault (11).
DoS Status: At this stage, the PoC achieves a reliable Denial of Service by corrupting the allocator's free list.
RCE Research Path To progress from a crash to execution, the following areas require further work:
Heap Grooming: Stabilizing the heap to ensure the corrupted chunk overlaps with a predictable structure.
Control Flow: Overwriting apr_pool_cleanup_register or similar function pointers to redirect execution.
ROP Chain: Building a chain to bypass NX/ASLR once the instruction pointer is controlled.
Files Dockerfile: Sets up a vulnerable 2.4.66 instance with HTTP/2 enabled.
poc.py: Script designed to trigger the race condition through rapid frame sequencing.
