Exploit for CVE-2026-23918-poc

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-BENCODIN-CVE-2026-23918-POC
# CVE-2026-23918 — Apache mod_http2 Double Free

**Affected:** Apache HTTP Server 2.4.66 with `mod_http2` \+ Event MPM  
**Fixed in:** Apache 2.4.67 (mod_h2 v2.0.37)  
**CVSS 3.1:** 8.8 HIGH — Unauthenticated Remote Code Execution possible  
**CWE:** CWE-415 (Double Free)

* * *

## What's the vulnerability

`mod_http2` in Apache 2.4.66 has a double-free bug inside `h2_mplx.c:m_stream_cleanup()`. The issue happens when a client sends a `HEADERS` frame immediately followed by a `RST_STREAM` on the same stream. If the timing is right, the stream ends up pushed twice into the `m->spurge` purge array. When the mplx gets destroyed, the APR pool is freed twice, which corrupts the heap and causes a SIGABRT or SIGSEGV.

Apache patched this in mod_h2 v2.0.37 by introducing `add_for_purge()`, a simple deduplication check that prevents the same stream from being added twice.

root@kitploit:~
    
    
    // Vulnerable (< v2.0.37)
    APR_ARRAY_PUSH(m->spurge, h2_stream *) = stream;  // can happen twice
    
    // Fixed (v2.0.37+)
    static int add_for_purge(h2_mplx *m, h2_stream *stream) {
        for (int i = 0; i < m->spurge->nelts; ++i)
            if (APR_ARRAY_IDX(m->spurge, i, h2_stream*) == stream)
                return FALSE;
        APR_ARRAY_PUSH(m->spurge, h2_stream *) = stream;
        return TRUE;
    }
    

* * *

## How the PoC works

By default the script runs a 3-phase pipeline on the target:

Phase| What it does  
---|---  
**1 — Recon**|  Detects Apache version, HTTP/2 support via ALPN, MPM type  
**2 — Exploit**|  Sends threaded HEADERS+RST_STREAM bursts, tries inline then staged mode  
**3 — RCE Assessment**|  Measures crash consistency and scores the risk level  
  
The RCE score is computed from three signals that are detectable remotely. First, whether Apache 2.4.66 is running. Second, whether Event or Worker MPM is in use (mod_http2 refuses to start with Prefork so if HTTP/2 works, it's a threaded MPM). Third, how deterministic the crash is — a crash on the first round means the heap corruption is controlled and reproducible, which is what you need for RCE.

* * *

## Installation

root@kitploit:~
    
    
    pip install hpack requests
    

* * *

## Usage

root@kitploit:~
    
    
    # Full PoC on a single target (default behavior)
    python poc.py -t 192.168.1.100
    
    # Increase pressure with more rounds, bigger bursts and more threads
    python poc.py -t 192.168.1.100 -n 20 -b 500 -w 5
    
    # Passive check only, nothing is sent to the target
    python poc.py -t example.com --check-only
    
    # Scan a whole list of targets
    python poc.py -l sites.txt -o results.json
    
    # Passive check on a list
    python poc.py -l sites.txt --check-only
    
    # Generate a Markdown report after the run
    python poc.py -t target.com --report report.md
    

### Options

### Target file format

root@kitploit:~
    
    
    # one target per line, comments are ignored
    192.168.1.100
    example.com
    example.com:8443
    https://example.com
    http://example.com:8080
    

* * *

## RCE risk levels

* * *

## How to patch

The proper fix is upgrading Apache to 2.4.67 or later. If you can't upgrade right away, disabling HTTP/2 removes the attack surface entirely:

root@kitploit:~
    
    
    # Before
    Protocols h2 http/1.1
    
    # After (disables HTTP/2)
    Protocols http/1.1
    

* * *

## Disclaimer

This tool is meant for authorized security testing and research only. Make sure you have explicit written permission before running it against any target. The author takes no responsibility for misuse.