CVE-2026-23918 audit script

alternatively you could just curl the headers and take a peek, but here comes the:

Non-invasive HTTP metadata auditor for Apache HTTP Server CVE-2026-23918 (https://www.openwall.com/lists/oss-security/2026/05/04/19) exposure triage.

The tool sends ordinary HTTP HEAD/GET requests and performs TLS ALPN negotiation to observe HTTP/2 support.

Requirements

• Python 3.13 or later
• uv

Install uv:

curl -LsSf https://astral.sh/uv/install.sh | sh

Common package-manager examples:

brew install uv [email protected]
sudo apt install python3.13 python3.13-venv pipx && pipx install uv
sudo dnf install python3.13 pipx && pipx install uv
sudo pacman -S uv python

Install project dependencies:

make install

Install developer dependencies for linting:

make install-dev

Usage

Print the command summary:

make help

Audit one target:

make run https://example.com

Print one-line CVE verdicts:

make run https://example.com brief

Audit targets from targets.json:

make run targets.json brief

Optional variables:

make run targets.json brief TIMEOUT=30 CONCURRENCY=10
make run https://example.com INSECURE=1
make run targets.json JSON_OUTPUT=1

Interactive terminals show a small ASCII spinner on stderr while requests are in progress. Report output remains on stdout.

Target File

targets.json must be a JSON array of hostnames, IP addresses, or URLs:

[
    "https://httpd.apache.org",
    "https://example.com",
    "http://scanme.nmap.org"
]

Equivalent generic format:

[
    "https://example.com",
    "example.org",
    "192.0.2.10",
    "http://192.0.2.20:8080"
]

Each entry must be a non-empty string. Bare hostnames and IP addresses are normalized to HTTPS.

Checks

• Server banner and Apache version extraction
• HTTP/2 indicators from response protocol, TLS ALPN, Alt-Svc, and Upgrade
• CVE-2026-23918 version triage
• Common security headers
• Cookie security attributes
• TLS verification status

Brief output format:

https://example.com  [Apache/2.4.66] [h2 no] => likely vulnerable (h2 not confirmed)

For CVE-2026-23918, Apache 2.4.66 is treated as affected and 2.4.67 or later as fixed. Older Apache releases are reported as outside the confirmed CVE range.

Layout

• audit.py: CLI entrypoint.
• auditor/: validation, passive collection, analysis, reporting, and progress display.

Exit Status

Successful execution exits with status 0 after reporting results. Findings, including vulnerable-looking banners, are data output and do not make the process fail.

Input validation failures and setup failures may exit non-zero.

Disclaimer

The results are based on externally visible metadata and are not authoritative proof of package state. Server banners may be hidden, modified, backported, or routed through intermediaries.

License

CC0 1.0 Universal. See LICENSE.