> **关键不对称性：** DoS 路径不需要堆操作技能，且正在被积极利用。RCE 路径技术难度高，但已在实验室条件下得到验证，且考虑到该计分牌具有 ASLR 抗性固定地址，几乎肯定会在近期被武器化。

---

## 检测架构

> 本节解释为何此处的检测工具与典型的本地权限提升套件存在显著差异。

Copy Fail (CVE-2026-31431) 是一种 **主机侧、访问后** 漏洞。攻击者需要在系统上已有存在感。检测主要位于系统调用层（auditd、Wazuh），同时使用 YARA 扫描磁盘上的 PoC 脚本。

CVE-2026-23918 是一种 **网络侧、访问前** 漏洞。利用载荷以 HTTP/2 协议帧的形式在应用代码运行之前通过线路到达。这显著改变了检测栈：

| 层面 | Copy Fail (LPE) | CVE-2026-23918 (RCE) |
|---|---|---|
| **主要检测** | Auditd 系统调用规则 | Suricata 网络规则 |
| **WAF (ModSecurity)** | 受限 — 无法看到利用 | 相关 — 异常检测 + 利用后检测 |
| **Auditd** | 核心检测 | 结果检测（崩溃、利用后行为） |
| **YARA** | 扫描 PoC 脚本 | 扫描 Web Shell（利用后产物） |
| **网络 IDS** | 不适用 | 第一层检测层 |
| **TLS 检查** | 不适用 | Suricata 全面覆盖所必需 |

经验法则：对于网络级 RCE，由外向内（网络 → WAF → 主机）排查。对于本地权限提升，由主机向外排查。

---

## 检测限制

> **在部署任何规则前请阅读此部分。**

**1. TLS 会终止 HTTP/2 可见性。**
大多数生产环境的 Apache 部署使用 HTTPS。如果没有配置 TLS 解密，Suricata 无法检查加密的 HTTP/2 帧内容。如果你的 Suricata 部署无法获取 TLS 会话密钥或解密镜像，则以下网络级规则只能捕获：
- 明文 HTTP/2 (h2c) — 生产中不常见，但在内部环境中存在
- TCP 连接行为的网络特征（连接数、TCP 层的 RST 模式）

对于 HTTPS 部署，请通过 `tls-decrypt` 设置和会话密钥日志启用 Suricata 的 TLS 解密，或者依赖 WAF（ModSecurity/Coraza）和基于主机（auditd/Wazuh）的检测层。

**2. ModSecurity 无法阻止利用触发。**
双重释放发生在 HTTP/2 帧解析器内部，此时完整的 HTTP 请求尚未组装并传递给 ModSecurity。WAF 仅在帧解析完成后才能看到请求——此时可能已造成损害。本工具包中的 ModSecurity 用于异常检测、速率限制和利用后检测，而不是作为触发的阻断层。

**3. MPM prefork 不受影响。**
如果你的 Apache 部署使用 `mpm_prefork_module`（单线程），则此漏洞不适用。该错误仅出现在多线程 MPM（`mpm_event_module` 或 `mpm_worker_module`）中。在部署可能导致 prefork 服务器产生误报的规则前，请使用 `apachectl -V | grep MPM` 进行检查。

**4. RCE 需要 mmap 分配器。**
RCE 路径（而非 DoS 路径）需要 APR 的 mmap 分配器，这是 Debian 衍生发行版和官方 Apache Docker 镜像的默认配置。使用 jemalloc 或系统 malloc 的 RHEL/CentOS 部署降低了对 RCE 的风险，但仍完全容易受到 DoS 攻击。

**5. 尚无稳定的利用后 IoC。**
截至本文撰写时，尚无厂商发布针对利用后活动的 IoC。针对利用后行为的 YARA 规则和 auditd 规则基于通用的 Web Shell 和权限提升模式——它们能够捕获常见结果，但无法应对复杂、定制的载荷。

---

## 即时缓解措施

按优先级顺序应用。每项虽比前一项更具破坏性，但每项也更为完整。```bash
# Option 1 (Preferred): Upgrade to 2.4.67
# See Patching & Remediation section below

# Option 2: Disable HTTP/2 in Apache config (no reboot required, restart required)
# In httpd.conf or relevant VirtualHost / site config:
#   Remove or comment out:  Protocols h2 h2c http/1.1
#   Replace with:           Protocols http/1.1
# Then:
apachectl configtest && sudo systemctl restart apache2

# Option 3: Switch to MPM prefork (eliminates vulnerability entirely — more disruptive)
sudo a2dismod mpm_event mpm_worker
sudo a2enmod mpm_prefork
apachectl configtest && sudo systemctl restart apache2

# Option 4: Reverse proxy HTTP/2 termination
# If nginx, HAProxy, or a CDN is in front of Apache and terminates HTTP/2,
# Apache only receives HTTP/1.1 — confirm your proxy config explicitly:
#   nginx: proxy_http_version 1.1; (already the default for upstream connections)
#   HAProxy: use-server-close + http/1.1 on backend bind
# Verify with: curl -v --http2 https://your-origin-directly

### 调优说明

在部署为 `alert` 模式 24–48 小时后，审查规则 3 和规则 4 的命中情况——合法 HTTP/2 客户端在高流量环境中可能触发这些规则。如果规则 1（应用层）捕获到了足够的告警信号，规则 3 和规则 4 可降为较低严重级别或直接移除。

对于启用了 `stream-depth` 限制的 Suricata 部署，请确保规则 4 中的 HTTP/2 前缀模式落入检测窗口内。

---

## ModSecurity / Coraza 配置

> **前提条件：**
> - ModSecurity 2.x（`libapache2-mod-security2`）或 [Coraza](https://coraza.io/)（即插即用替代品，积极维护中）
> - 建议使用 OWASP 核心规则集 (CRS) 4.x：[coreruleset.org/installation](https://coreruleset.org/installation/)
> - `SecRuleEngine On`（或在初始调优期间使用 `DetectionOnly` 仅记录模式）

### 为何 ModSecurity 与此相关（但尚不足够）

如“检测局限性”部分所述，ModSecurity 无法拦截 double-free 触发器，因为该漏洞利用在 HTTP/2 帧层运行。然而，ModSecurity 为此 CVE 提供了三层有意义的价值：

1. **速率限制**——减缓自动化 DoS 扫描，并增加暴力破解 RCE 堆喷射的成本
2. **后利用检测**——若 RCE 得逞，攻击者将尝试部署 Web shell 或执行命令；ModSecurity 可捕获这两者
3. **OWASP CRS 异常评分**——与利用相关的畸形标头和连接模式在 CRS 偏执级别 2+ 下可能产生异常评分

### Apache 配置加固（与 ModSecurity 配合使用）

添加到 `httpd.conf` 或包含文件中。这些是 Apache 指令，而非 ModSecurity 规则，但它们能缩小 HTTP/2 的攻击面：```apache
# ============================================================
# CVE-2026-23918 Apache HTTP/2 Hardening Directives
# ============================================================

# Limit concurrent streams per HTTP/2 session.
# The exploit typically uses 1 stream, but limiting sessions
# reduces the rate at which a single client can attempt the trigger.
H2MaxSessionRequests 100

# Restrict H2 stream push (unused surface, reduce complexity)
H2Push Off

# Suppress version information in Server headers.
# Prevents trivial identification of vulnerable 2.4.66 instances.
ServerTokens Prod
ServerSignature Off

# Constrain HTTP/2 window size — reduces memory available for heap spray
H2WindowSize 65535

# If HTTP/2 is not required at all:
# Protocols http/1.1

### OWASP CRS 调优建议

为了在不产生过多误报的情况下获得最高的异常信号，请将 CRS 部署在偏执等级 2 并启用异常评分。触发连接行为（格式错误的 HTTP/2 导致 HTTP/1.x 回退错误、重复重置）将在 CRS 规则 920xxx 和 921xxx 下累积异常分数，并可能超过默认的 `inbound_anomaly_score_threshold` 值 5，从而在无需自定义规则的情况下生成警报。

---

## Auditd 规则

Save as `/etc/audit/rules.d/cve-2026-23918.rules`

Reload with: `sudo augenrules --load`

> **设计原则：** 由于漏洞触发位于网络/内核 HTTP/2 解析层，auditd 无法捕获触发本身。这些规则检测：
> 1. DoS 利用的**结果**（Apache 工作进程崩溃信号）
> 2. 如果实现了 RCE，**后利用活动**（shell 执行、文件写入、Apache 用户的出站连接）```bash
## ============================================================
## CVE-2026-23918 Apache HTTP/2 Double-Free — Auditd Rules
## ============================================================
## These rules detect the CONSEQUENCES of exploitation, not the
## trigger. The trigger is a network protocol event and is
## detected by Suricata. These rules catch:
##   1. Apache worker process crashes (DoS outcome)
##   2. Shell execution by the web server user (RCE outcome)
##   3. Web root file creation (web shell deployment)
##   4. Outbound network connections by web server process (reverse shell)
##
## Distribution notes for UID values:
##   - Debian/Ubuntu: www-data = uid 33
##   - RHEL/Rocky/CentOS: apache = uid 48
##   Adjust -F uid= values for your distribution. Use `id www-data`
##   or `id apache` to confirm the UID on your systems.
## ============================================================

## --- Apache worker SIGABRT detection (DoS exploitation outcome) ---
## A double-free that reaches the crash path generates SIGABRT (signal 6).
## Monitoring kill() syscalls with a1=6 (SIGABRT) targets abnormal process
## termination, which Apache itself triggers on double-free detection.
## Correlate with Apache error log entries (child exited with signal 6).
-a always,exit -F arch=b64 -S kill -F a1=6 -k cve_2026_23918_sigabrt
-a always,exit -F arch=b32 -S kill -F a1=6 -k cve_2026_23918_sigabrt

## --- SIGSEGV monitoring (alternative crash path) ---
## Depending on heap state, the double-free may produce a SIGSEGV (signal 11)
## rather than SIGABRT. Both are abnormal for production Apache workers.
-a always,exit -F arch=b64 -S kill -F a1=11 -k cve_2026_23918_sigsegv
-a always,exit -F arch=b32 -S kill -F a1=11 -k cve_2026_23918_sigsegv

## --- Shell execution by web server user (RCE outcome - Debian/Ubuntu) ---
## If RCE is achieved via the mmap allocator path, the attacker's payload
## runs as the Apache worker user (www-data on Debian/Ubuntu, uid=33).
## Legitimate Apache does not exec() a shell. Any execve() of bash/sh/dash
## by www-data is anomalous and warrants immediate investigation.
-a always,exit -F arch=b64 -S execve -F uid=33 -F exe=/bin/bash -k cve_2026_23918_rce_shell_deb
-a always,exit -F arch=b64 -S execve -F uid=33 -F exe=/bin/sh   -k cve_2026_23918_rce_shell_deb
-a always,exit -F arch=b64 -S execve -F uid=33 -F exe=/bin/dash -k cve_2026_23918_rce_shell_deb
-a always,exit -F arch=b64 -S execve -F uid=33 -F exe=/usr/bin/python3 -k cve_2026_23918_rce_shell_deb
-a always,exit -F arch=b64 -S execve -F uid=33 -F exe=/usr/bin/perl -k cve_2026_23918_rce_shell_deb

## --- Shell execution by web server user (RCE outcome - RHEL/Rocky, uid=48) ---
-a always,exit -F arch=b64 -S execve -F uid=48 -F exe=/bin/bash -k cve_2026_23918_rce_shell_rhel
-a always,exit -F arch=b64 -S execve -F uid=48 -F exe=/bin/sh   -k cve_2026_23918_rce_shell_rhel

## --- Web root file creation (web shell deployment) ---
## Post-RCE, the most common next step is writing a persistent web shell.
## Monitor web root directories for new file creation and write operations.
## Adjust paths for your DocumentRoot configuration.
-w /var/www/html     -p wa -k cve_2026_23918_webroot_write
-w /var/www          -p wa -k cve_2026_23918_webroot_write
-w /srv/www          -p wa -k cve_2026_23918_webroot_write
-w /usr/share/apache2/default-site -p wa -k cve_2026_23918_webroot_write

## --- Outbound network connections by web server user (reverse shell) ---
## Apache workers do not normally initiate outbound TCP connections.
## connect() syscalls by www-data/apache indicate post-exploitation activity.
-a always,exit -F arch=b64 -S connect -F uid=33 -k cve_2026_23918_apache_outbound_deb
-a always,exit -F arch=b64 -S connect -F uid=48 -k cve_2026_23918_apache_outbound_rhel

## --- Apache config and module modification (persistence) ---
## An attacker with RCE may attempt to persist by modifying Apache config
## or dropping a malicious module. Watch for writes to config directories.
-w /etc/apache2      -p wa -k cve_2026_23918_apache_config
-w /etc/httpd        -p wa -k cve_2026_23918_apache_config
-w /etc/apache2/mods-enabled -p wa -k cve_2026_23918_apache_mods

---

## Wazuh 规则

保存为自定义规则文件（例如：`/var/ossec/etc/rules/local_rules.xml`）。

> **先决条件：**
> - 已部署上述 Auditd 规则且 Wazuh auditd 解码器已激活
> - Apache 错误日志（`/var/log/apache2/error.log` 或 `/var/log/httpd/error_log`）已添加到 Wazuh 监控文件列表
> - 监控 Apache 访问日志中的 HTTP/2 连接错误模式```xml
<!-- ==============================================================
     CVE-2026-23918 Apache HTTP/2 Double-Free — Wazuh Rules
     Requires:
       - auditd rules from cve-2026-23918.rules deployed
       - Apache error log monitored by Wazuh agent
     ============================================================== -->

<!-- Level 10: Apache worker crash signal (SIGABRT) detected via auditd -->
<rule id="113001" level="10">
    <if_group>auditd</if_group>
    <field name="audit.key">cve_2026_23918_sigabrt</field>
    <description>CVE-2026-23918: SIGABRT sent to process — possible Apache worker double-free crash (DoS exploitation)</description>
    <group>cve,denial_of_service,apache,http2,</group>
</rule>

<!-- Level 10: SIGSEGV variant crash path -->
<rule id="113002" level="10">
    <if_group>auditd</if_group>
    <field name="audit.key">cve_2026_23918_sigsegv</field>
    <description>CVE-2026-23918: SIGSEGV sent to process — possible Apache worker memory corruption crash</description>
    <group>cve,denial_of_service,apache,http2,</group>
</rule>

<!-- Level 14 CRITICAL: Multiple worker crashes in short window — active DoS -->
<rule id="113003" level="14" frequency="3" timeframe="60">
    <if_matched_sid>113001</if_matched_sid>
    <description>CVE-2026-23918 CRITICAL: Multiple Apache worker SIGABRT crashes within 60 seconds — active DoS exploitation in progress</description>
    <group>cve,denial_of_service,apache,http2,high_confidence,</group>
</rule>

<!-- Level 15 CRITICAL: Shell execution by web server user — RCE achieved -->
<rule id="113004" level="15">
    <if_group>auditd</if_group>
    <field name="audit.key">cve_2026_23918_rce_shell_deb|cve_2026_23918_rce_shell_rhel</field>
    <description>CVE-2026-23918 CRITICAL: Shell executed by web server user (www-data/apache) — RCE likely achieved, immediate incident response required</description>
    <group>cve,rce,privilege_escalation,apache,http2,high_confidence,</group>
</rule>

<!-- Level 14 CRITICAL: Web shell written to web root -->
<rule id="113005" level="14">
    <if_group>auditd</if_group>
    <field name="audit.key">cve_2026_23918_webroot_write</field>
    <description>CVE-2026-23918: File written to web root directory — possible web shell deployment post-RCE</description>
    <group>cve,rce,webshell,apache,</group>
</rule>

<!-- Level 13 CRITICAL: Outbound connection by Apache worker process -->
<rule id="113006" level="13">
    <if_group>auditd</if_group>
    <field name="audit.key">cve_2026_23918_apache_outbound_deb|cve_2026_23918_apache_outbound_rhel</field>
    <description>CVE-2026-23918: Outbound TCP connection by web server user — possible reverse shell post-RCE</description>
    <group>cve,rce,reverse_shell,apache,</group>
</rule>

<!-- Level 14: RCE shell followed by outbound connection (reverse shell confirmed) -->
<rule id="113007" level="14">
    <if_matched_sid>113004</if_matched_sid>
    <if_group>auditd</if_group>
    <field name="audit.key">cve_2026_23918_apache_outbound_deb|cve_2026_23918_apache_outbound_rhel</field>
    <description>CVE-2026-23918 CRITICAL: Shell execution AND outbound connection by web server user — reverse shell active</description>
    <group>cve,rce,reverse_shell,apache,high_confidence,</group>
</rule>

<!-- Level 12: Apache config modified (persistence attempt) -->
<rule id="113008" level="12">
    <if_group>auditd</if_group>
    <field name="audit.key">cve_2026_23918_apache_config|cve_2026_23918_apache_mods</field>
    <description>CVE-2026-23918: Apache config or module directory modified — possible attacker persistence attempt</description>
    <group>cve,rce,persistence,apache,</group>
</rule>

<!-- Level 10: Apache error log — child process crash (log-based correlation) -->
<!-- Requires Apache error log monitored by Wazuh, decoded via apache decoder -->
<rule id="113009" level="10">
    <decoded_as>apache-errorlog</decoded_as>
    <match>child pid \d+ exit signal Aborted|child process \d+ still did not exit|segmentation fault</match>
    <description>CVE-2026-23918: Apache child process crash in error log — possible double-free DoS exploitation</description>
    <group>cve,denial_of_service,apache,http2,</group>
</rule>

<!-- Level 13: Multiple Apache child crashes in error log + auditd SIGABRT (high confidence) -->
<rule id="113010" level="13">
    <if_matched_sid>113009</if_matched_sid>
    <if_matched_sid>113001</if_matched_sid>
    <description>CVE-2026-23918: Apache error log crash + auditd SIGABRT — high-confidence active DoS, investigate immediately</description>
    <group>cve,denial_of_service,apache,http2,high_confidence,</group>
</rule>

strings:
    $php_open       = "<?php" ascii nocase
    $php_short      = "<?" ascii nocase

    // OS command execution functions
    $sys            = "system("       ascii nocase
    $exec           = "exec("         ascii nocase
    $passthru       = "passthru("     ascii nocase
    $shell_exec     = "shell_exec("   ascii nocase
    $popen          = "popen("        ascii nocase
    $proc_open      = "proc_open("    ascii nocase

    // Parameter sourcing — required for command injection
    $get_param      = "$_GET["        ascii
    $post_param     = "$_POST["       ascii
    $req_param      = "$_REQUEST["    ascii
    $cookie_param   = "$_COOKIE["     ascii
    $server_param   = "$_SERVER["     ascii

    // Obfuscation patterns common in web shells
    $b64decode      = "base64_decode(" ascii nocase
    $str_rot13      = "str_rot13("    ascii nocase
    $gzinflate      = "gzinflate("    ascii nocase
    $eval_call      = "eval("         ascii nocase

    // Common web shell capability strings
    $phpinfo        = "phpinfo()"     ascii nocase
    $file_put       = "file_put_contents(" ascii nocase

condition:
    filesize < 512KB and
    (
        // Classic command web shell: PHP + execution function + parameter input
        ($php_open or $php_short) and
        any of ($sys, $exec, $passthru, $shell_exec, $popen, $proc_open) and
        any of ($get_param, $post_param, $req_param, $cookie_param)
    )
    or
    (
        // Obfuscated web shell: eval + decode chain
        ($php_open or $php_short) and
        $eval_call and
        any of ($b64decode, $str_rot13, $gzinflate)
    )

strings:
    // Bash TCP reverse shell
    $bash_tcp       = "/dev/tcp/"                   ascii
    $bash_rev       = "bash -i >&"                  ascii nocase

    // Netcat reverse shell
    $nc_e           = "nc -e /bin/"                 ascii nocase
    $nc_c           = "nc -c /bin/"                 ascii nocase
    $ncat_e         = "ncat -e /bin/"               ascii nocase

    // Python reverse shell
    $py_socket      = "import socket,subprocess"    ascii
    $py_pty         = "import pty;pty.spawn"        ascii

    // Perl reverse shell
    $perl_rev       = "perl -e 'use Socket"        ascii

    // Common reverse shell via curl/wget pipe to bash
    $curl_bash      = "curl http"                   ascii
    $wget_bash      = "wget -O- http"               ascii
    $bash_pipe      = "|bash"                       ascii

condition:
    filesize < 1MB and
    (
        ($bash_tcp and $bash_rev)
        or ($nc_e or $nc_c or $ncat_e)
        or ($py_socket and $py_pty)
        or $perl_rev
        or ($curl_bash and $bash_pipe)
        or ($wget_bash and $bash_pipe)
    )

strings:
    // h2_mplx.c specific identifier from public PoC analysis
    $mplx_ref       = "h2_mplx_c1_client_rst"      ascii
    $spurge_ref     = "c1_purge_streams"            ascii
    $stream_ref     = "h2_stream_destroy"           ascii

    // CVE reference strings that appear in PoC tools
    $cve_str        = "CVE-2026-23918"              ascii
    $version_target = "Apache/2.4.66"               ascii

    // HTTP/2 HEADERS + RST_STREAM frame bytes (common in PoC HTTP/2 libraries)
    // HTTP/2 HEADERS frame header: type=0x01
    $h2_headers_frame  = { 00 00 ?? 01 }
    // HTTP/2 RST_STREAM frame header: type=0x03 with payload=4
    $h2_rst_frame      = { 00 00 04 03 00 }

    // Python h2 library usage (hyper-h2) typical in PoC tools
    $hyper_h2       = "import h2"                   ascii
    $h2_connection  = "H2Connection"                ascii

condition:
    (
        ($mplx_ref or $spurge_ref or $stream_ref)
        or
        ($cve_str and $version_target)
        or
        ($hyper_h2 and $h2_connection and $h2_rst_frame)
    )

---

## MISP 事件模板

保存为 `misp_cve_2026_23918.json` 并通过 MISP → 事件 → 导入 进行导入。

> 在导入前，将占位符 UUID 替换为新生成的 UUID4。```json
{
    "Event": {
        "uuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "info": "CVE-2026-23918 Apache mod_http2 Double-Free — Remote DoS and possible RCE",
        "threat_level_id": "2",
        "analysis": "2",
        "date": "2026-05-04",
        "Attribute": [
            {
                "type": "vulnerability",
                "category": "External analysis",
                "to_ids": false,
                "uuid": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
                "comment": "CVE identifier",
                "value": "CVE-2026-23918"
            },
            {
                "type": "text",
                "category": "Other",
                "to_ids": false,
                "uuid": "c3d4e5f6-a7b8-9012-cdef-012345678902",
                "comment": "Vulnerability description",
                "value": "Double-free in Apache HTTP Server 2.4.66 mod_http2 h2_mplx.c stream cleanup path. Triggered by HTTP/2 HEADERS frame immediately followed by RST_STREAM with non-zero error code before stream registration. Results in DoS (confirmed in-wild) or RCE (lab-demonstrated) in multi-threaded MPM configurations."
            },
            {
                "type": "text",
                "category": "Other",
                "to_ids": false,
                "uuid": "d4e5f6a7-b8c9-0123-defa-123456789003",
                "comment": "Affected component",
                "value": "Apache HTTP Server 2.4.66, mod_http2 module, h2_mplx.c — multi-threaded MPM only (event, worker). MPM prefork is NOT affected."
            },
            {
                "type": "text",
                "category": "Other",
                "to_ids": false,
                "uuid": "e5f6a7b8-c9d0-1234-efab-234567890104",
                "comment": "RCE precondition",
                "value": "RCE requires APR mmap allocator (default on Debian/Ubuntu and official Apache Docker images). Scoreboard at fixed address bypasses ASLR for practical exploitation."
            },
            {
                "type": "text",
                "category": "Other",
                "to_ids": false,
                "uuid": "f6a7b8c9-d0e1-2345-fabc-345678901205",
                "comment": "Fix commit — r1930444",
                "value": "https://svn.apache.org/viewvc?view=revision&revision=1930444"
            },
            {
                "type": "text",
                "category": "Other",
                "to_ids": false,
                "uuid": "a7b8c9d0-e1f2-3456-abcd-456789012306",
                "comment": "Fix commit — r1930796",
                "value": "https://svn.apache.org/viewvc?view=revision&revision=1930796"
            },
            {
                "type": "text",
                "category": "Other",
                "to_ids": true,
                "uuid": "b8c9d0e1-f2a3-4567-bcde-567890123407",
                "comment": "IoC: HTTP/2 frame trigger sequence",
                "value": "HTTP/2 HEADERS frame (type=0x01) immediately followed by RST_STREAM (type=0x03) with non-zero error code, same stream ID, before multiplexer stream registration"
            },
            {
                "type": "text",
                "category": "Other",
                "to_ids": true,
                "uuid": "c9d0e1f2-a3b4-5678-cdef-678901234508",
                "comment": "IoC: RST_STREAM frame bytes (raw)",
                "value": "00 00 04 03 00 [stream_id 4 bytes] [non-zero error code 4 bytes]"
            },
            {
                "type": "text",
                "category": "Other",
                "to_ids": true,
                "uuid": "d0e1f2a3-b4c5-6789-defa-789012345609",
                "comment": "IoC: Server response header (vulnerable version)",
                "value": "Server: Apache/2.4.66"
            },
            {
                "type": "text",
                "category": "Other",
                "to_ids": true,
                "uuid": "e1f2a3b4-c5d6-7890-efab-890123456710",
                "comment": "Exploitation status",
                "value": "DoS exploitation confirmed in the wild. RCE demonstrated in lab conditions; widespread weaponization anticipated."
            },
            {
                "type": "text",
                "category": "Other",
                "to_ids": false,
                "uuid": "f2a3b4c5-d6e7-8901-fabc-901234567811",
                "comment": "Immediate mitigation",
                "value": "Disable mod_http2: remove 'Protocols h2 h2c' from Apache config and restart. Or switch to MPM prefork. Definitive fix: upgrade to Apache HTTP Server 2.4.67."
            },
            {
                "type": "url",
                "category": "External analysis",
                "to_ids": false,
                "uuid": "a3b4c5d6-e7f8-9012-abcd-012345678912",
                "comment": "Apache official advisory",
                "value": "https://httpd.apache.org/security/vulnerabilities_24.html"
            },
            {
                "type": "url",
                "category": "External analysis",
                "to_ids": false,
                "uuid": "b4c5d6e7-f8a9-0123-bcde-123456789013",
                "comment": "oss-security disclosure",
                "value": "https://seclists.org/oss-sec/2026/q2/387"
            }
        ],
        "Object": [
            {
                "name": "vulnerability",
                "meta-category": "vulnerability",
                "Attribute": [
                    {
                        "type": "vulnerability",
                        "object_relation": "id",
                        "value": "CVE-2026-23918"
                    },
                    {
                        "type": "cvss-score",
                        "object_relation": "cvss-score",
                        "value": "8.8"
                    },
                    {
                        "type": "text",
                        "object_relation": "summary",
                        "value": "Apache mod_http2 double-free via HTTP/2 early reset — remote DoS and possible RCE"
                    }
                ]
            }
        ]
    }
}

### 2.4.67 版本修复的其他 CVE

2.4.67 版本修复了五个 CVE。除 CVE-2026-23918 外，最严重的两个是：

- **CVE-2026-24072** — Windows 上通过 CGI 脚本处理导致的权限提升（仅影响 Windows 部署）
- **CVE-2026-24081** — `mod_rewrite` 表达式求值允许 `.htaccess` 作者以 httpd 用户身份读取任意文件（影响 2.4.66 及更早版本，于 2026-01-20 报告）
- **CVE-2026-24088** — `mod_proxy_ajp` 中通过恶意 AJP 后端发送的精心构造的 AJP 消息导致的堆缓冲区溢出（影响 2.4.66 及更早版本）

升级到 2.4.67 可一次性修复所有五个漏洞。

---

## 关键入侵指标参考

| 指标 | 值 | 置信度 | 备注 |
|---|---|---|---|
| 受影响版本 | Server 标头中的 `Apache/2.4.66` | **高** | 仅出现即表示存在暴露风险 |
| HTTP/2 帧类型 | RST_STREAM (0x03) 且错误码非零 | 中 | 合法连接错误也会产生相同情况 |
| 帧字节模式 | `00 00 04 03 00` (RST_STREAM 头部) | 中 | 结合阈值则为高 |
| RST 洪泛阈值 | 30 秒内同一来源发送超过 10 个非零错误码的 RST_STREAM | **高** | 与野外 DoS 工具行为一致 |
| Apache 工作进程 SIGABRT | 向 `httpd`/`apache2` PID 发送信号 6 | **高** | 正常工作进程不会中止 |
| www-data 执行 shell | uid 33 或 48 执行 `execve()` 调用 bash/sh | **严重** | 强烈表明存在 RCE |
| Apache 用户发起出站连接 | uid 33 或 48 向外部 IP 发起 `connect()` | **严重** | 强烈表明存在反弹 shell |
| Web 根目录下创建 web 文件 | `/var/www` 目录下新增 `.php`/`.py`/`.sh` 文件 | **高** | 可能表明部署了 web shell |
| MPM 类型 | `mpm_prefork` | 不适用 — **不受影响** | 通过 `apachectl -V \| grep MPM` 验证 |
| RCE 前提条件 | APR mmap 分配器 | 视情况而定 | Debian/Ubuntu 默认使用；RHEL 非默认 |

---

*检测包依据 Apache HTTP Server 安全公告维护，见 [httpd.apache.org/security](https://httpd.apache.org/security/)。如果您观察到这些规则未涵盖的利用变种或后利用模式，请提交 issue。*