CVE-2026-23918

CVE-2026-23918 Apache httpd 的 modhttp2 流清理中存在双重释放漏洞，可导致预认证 RCE。 受影响版本：启用 modhttp2 和多线程 MPM（event/worker）的 httpd 2.4.66。 修复版本：2.4.67。 由 Bartlomiej Dmitruk striga.ai 和 Stanislaw Strzalkowski isec.pl 发现并报告。 技术分析：https://striga.ai/research/apache-httpd-mod-http2-double-free 环境要求 Docker Python 3 使用方法...

Detections-CVE-2026-23918

MOVING TO: https://github.com/insomnisec/publiccvedetections FOR BETTER LONG TERM MANAGEMENT OF DETECTION PUBLICATIONS THIS REPO WILL BE REMOVED IN JUNE 2026 PLEASE USE THE OTHER REPO GOING FORWARD CVE-2026-23918 "Apache HTTP/2 Double-Free" — Detection & Response Package Published: 2026-05-04...

CVE-2026-18924 HTTP/2 server push UAF

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

CVE-2026-18549

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts t...

libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service

A flaw was found in libcurl. This use-after-free vulnerability occurs when an application configures an HTTP/2 stream-dependency tree and then performs a sequence of operations involving curleasyreset and curleasycleanup. During the final cleanup, libcurl attempts to access memory that has alread...

Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service

Exploit Title: Apache HTTP Server 2.4.66 - 'modhttp2' Double-Free Denial of Service Google Dork: intext:"Apache/2.4.66" "HTTP/2" Date: 2026-05-06 Exploit Author: xeloxa https://github.com/xeloxa/ Vendor Homepage: https://httpd.apache.org/ Software Link:...

Exploit for Double Free in Apache Http_Server

CVE-2026-23918 "Apache HTTP/2 Double-Free" — Detection & Respo...

CVE-2026-31599 media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections

In the Linux kernel, the following vulnerability has been resolved: media: vidtv: fix NULL pointer dereference in vidtvchannelpmtmatchsections syzbot reported a general protection fault in vidtvpsidescassign 1. vidtvpsipmtstreaminit can return NULL on memory allocation failure, but...

CVE-2025-68262

In the Linux kernel, the following vulnerability has been resolved: crypto: zstd - fix double-free in per-CPU stream cleanup The crypto/zstd module has a double-free bug that occurs when multiple tfms are allocated and freed. The issue happens because zstdstreams per-CPU contexts are freed in...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a double release per CPU stream cleanup in crypto:zstd...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the imx8-isi driver not properly handling stream cleanup, which could lead to a resource leak...

Fedora 30 : mod_http2 (2019-63ba15cc83) (0-Length Headers Leak) (Data Dribble) (Internal Data Buffering)

Rebuilt with newer nghttp2 ---- This update includes the latest upstream release of modhttp2, version 1.15.3. Upstream changes include : - fixes Timeout vs. KeepAliveTimeout behaviour, see PR 63534. - Fixes stream cleanup when connection throttling is in place. - Counts stream resets by client on...

Ubuntu 6.06 LTS / 6.10 / 7.04 : libvorbis vulnerabilities (USN-498-1)

David Thiel discovered that libvorbis did not correctly verify the size of certain headers, and did not correctly clean up a broken stream. If a user were tricked into processing a specially crafted Vorbis stream, a remote attacker could execute arbitrary code with the user's privileges. Note tha...

USN-498-1: libvorbis vulnerabilities

David Thiel discovered that libvorbis did not correctly verify the size of certain headers, and did not correctly clean up a broken stream. If a user were tricked into processing a specially crafted Vorbis stream, a remote attacker could execute arbitrary code with the user's privileges...