cve-2026-23918

Defensive audit tools for CVE-2026-23918 (Apache HTTPD HTTP/2 double-free RCE) and four related CVEs disclosed in the May 4, 2026 Apache Software Foundation security advisory.

All issues are patched in Apache HTTP Server 2.4.67.

⚠️ Authorization & Scope

These tools are intended for use only against systems you own or have explicit written authorization to test. Unauthorized scanning may be illegal in your jurisdiction.

The toolkit is defensive by design:

• No vulnerability payloads, no exploit attempts, no intrusive probing.
• The passive scanner reads only the standard Server: HTTP header and uses standard TLS ALPN — the same mechanism every modern browser uses to negotiate HTTP/2.
• The local auditor is read-only; no file or configuration is modified.

Contents

.
├── apache_passive_audit.py    # External asset audit (banner-grab + ALPN)
├── apache_local_audit.py      # On-host / SSH local audit
├── LICENSE                    # MIT
├── .gitignore
└── README.md

Requirements

• Python 3.6+ — works on Ubuntu 18.04's default python3 and every later release.
• Standard library only — no external dependencies.

Installation

git clone https://github.com/sibersan/cve-2026-23918.git
cd cve-2026-23918
chmod +x apache_passive_audit.py apache_local_audit.py

1. Passive Audit — apache_passive_audit.py

Reads the HTTP Server: header to detect the Apache version and matches it against the CVE table. Additionally, for HTTPS targets, performs a standard TLS ALPN negotiation to determine whether HTTP/2 is exposed — this is the key precondition for CVE-2026-23918 to be exploitable. No exploit payloads are sent.

HTTP/2 verification (ALPN)

The script offers h2 and http/1.1 in the TLS handshake's ALPN extension (RFC 7301). The server's choice is the standard, unambiguous answer to "is HTTP/2 enabled?" — used by every modern browser and curl. It does not trigger the vulnerability or any unusual behavior.

The risk verdict reflects this:

• Version 2.4.66 + HTTP/2 confirmed via ALPN → VULNERABLE (RCE vector open)
• Version 2.4.66 + HTTP/2 not negotiated → AT_RISK (still unpatched; other low/moderate CVEs apply, but the High-severity RCE vector is closed)
• ALPN test could not be performed → conservative; assume exposed
• Version ≥ 2.4.67 → SAFE

Usage

# Single target
python3 apache_passive_audit.py -t https://web.example.com

# Multiple targets
python3 apache_passive_audit.py -t https://a.example.com -t https://b.example.com

# Targets file, parallel, CSV + JSON output
python3 apache_passive_audit.py -f targets.txt -w 20 -o report.csv --json report.json

# CI / log-friendly (no colors)
python3 apache_passive_audit.py -f targets.txt --no-color

targets.txt format (one target per line, # for comments):

https://www.example.com
intranet.example.local:8443
# old staging box
http://10.0.5.12

Options

Exit codes (CI/CD friendly)

Risk levels

Limitations

• Servers with ServerTokens Prod or Minimal hide the version — the script honestly returns UNKNOWN. Use the local audit to confirm.
• An Apache instance behind a reverse proxy (Cloudflare, F5, nginx, etc.) may not expose its version at the edge.
• ALPN HTTP/2 detection is meaningful only for HTTPS targets. HTTP/2 cleartext (h2c) is rare in practice and not tested.

2. Local Audit — apache_local_audit.py

Runs on the target host (or via SSH) and inspects the Apache binary, version, loaded modules, and HTTP/2 configuration. It also evaluates exploitability preconditions: e.g. if the version is 2.4.66 but HTTP/2 is disabled, the risk for CVE-2026-23918 is downgraded accordingly.

Usage

sudo python3 apache_local_audit.py

# JSON report (for centralized inventory)
sudo python3 apache_local_audit.py --json /var/log/apache_audit_$(hostname).json

# Custom binary path
sudo python3 apache_local_audit.py --binary /opt/apache/bin/httpd

Detection capabilities

• httpd -v / apache2 -v — version
• httpd -V — build info, HTTPD_ROOT, SERVER_CONFIG_FILE
• apache2ctl -M or httpd -M — loaded modules
• dpkg-query / rpm -q — package version
• Main configuration plus all files pulled in via Include/IncludeOptional (including Debian's sites-enabled/, mods-enabled/) → Protocols directive (h2 / h2c / http/1.1)

Options

Exit codes

Risk levels

Privileges

sudo/root is recommended for full configuration reads. Without it, some files in sites-enabled/, mods-enabled/, or /etc/httpd/conf.d/ may be unreadable.

Running across an inventory

To run the local audit on multiple hosts and collect reports centrally, an Ansible ad-hoc example:

ansible all -i inventory.ini -b -m script \
  -a "apache_local_audit.py --json /tmp/apache_audit.json --no-color"

ansible all -i inventory.ini -b -m fetch \
  -a "src=/tmp/apache_audit.json dest=./reports/ flat=no"

Collected JSON files can be merged with jq or a small Python script.

Recommended Mitigations

For CVE-2026-23918 (until patched):

1. Upgrade Apache HTTP Server to 2.4.67 or later — the only permanent fix.
2. As an interim measure, disable HTTP/2: remove h2 and h2c from the Protocols directive in your configuration, or sudo a2dismod http2 on Debian/Ubuntu, then reload the service.
3. Unload mod_dav_lock if not in use (CVE-2026-29169).
4. Audit users / virtual hosts with .htaccess write access (CVE-2026-24072).

Official advisory: https://httpd.apache.org/security/vulnerabilities_24.html

Contributing

Pull requests are welcome. When adding a new CVE, please:

• Add an entry to CVE_TABLE with the affected version range and match lambda.
• For the local script, define the appropriate needs field for precondition checks (loaded module, enabled protocol, etc.).
• Update the README table.
• Maintain Python 3.6 compatibility: avoid f-strings, from __future__ import annotations, PEP 585 generics (list[int]), subprocess.run(capture_output=True), and @dataclass.

Maintainer

SiberSAN

License

MIT © 2026 SiberSAN

Disclaimer

This software is provided "as is", without warranty of any kind. Validate in a test environment before production use. The user assumes all legal responsibility for any use against unauthorized systems.