Lucene search
+L

559 matches found

Kitploit
Kitploit
added 2026/09/14 12:26 p.m.9 views

CVE-2026-23918

CVE-2026-23918: Apache HTTP/2 Double-Free DoS CVE-2026-23918 | Apache HTTP Server 2.4.66 | CWE-415: Double Free | CVSS 8.8 | Fixed in 2.4.67 A double-free vulnerability in modhttp2 h2mplx.c allows remote attackers to cause a denial of service worker crash via rapid RSTSTREAM frames that trigger a...

8.8CVSS8AI score0.49727EPSS
SaveExploits18
Kitploit
Kitploit
added 2026/09/14 7:08 a.m.8 views

CVE-2026-23918

CVE-2026-23918 Double-free in Apache httpd modhttp2 stream cleanup leading to pre-auth RCE. Affected: httpd 2.4.66 with modhttp2 and multi-threaded MPM event/worker. Fixed in: 2.4.67. Found and reported by Bartlomiej Dmitruk striga.ai and Stanislaw Strzalkowski isec.pl. Writeup:...

8.8CVSS8.1AI score0.49727EPSS
SaveExploits18
Kitploit
Kitploit
added 2026/09/14 4:42 a.m.6 views

CVE-2026-23918-Double-free-Apache-httpd-mod_http2

CVE-2026-23918 - Apache httpd modhttp2 PoC This repository contains a proof-of-concept implementation written in Go for a pre-authentication memory corruption scenario affecting Apache httpd with modhttp2. The code in this repository demonstrates a spray-and-trigger approach against a vulnerable...

8.8CVSS8.2AI score0.49727EPSS
SaveExploits18References4
Kitploit
Kitploit
added 2026/09/11 5:46 a.m.7 views

CVE-2026-23918

CVE-2026-23918 Apache modhttp2 Double-Free Detector https://github.com/user-attachments/assets/d6c30e58-548c-4b6d-9ba3-baa667238a58 root@kitploit: python3 h2ghost.py -h usage: h2ghost.py -h --host HOST --port PORT --tls --no-tls --iterations ITERATIONS --burst-n BURSTN --timeout TIMEOUT...

8.8CVSS8AI score0.49727EPSS
SaveExploits18References1
Kitploit
Kitploit
added 2026/09/10 11:44 p.m.9 views

Detections-CVE-2026-23918

MOVING TO: https://github.com/insomnisec/publiccvedetections FOR BETTER LONG TERM MANAGEMENT OF DETECTION PUBLICATIONS THIS REPO WILL BE REMOVED IN JUNE 2026 PLEASE USE THE OTHER REPO GOING FORWARD CVE-2026-23918 "Apache HTTP/2 Double-Free" — Detection & Response Package Published: 2026-05-04...

8.8CVSS7.8AI score0.49727EPSS
SaveExploits18References1
Kitploit
Kitploit
added 2026/09/10 1:44 a.m.7 views

CVE-2026-23918-Apache-H2-PoC

CVE-2026-23918-Apache-H2-PoC This is a proof-of-concept exploit for the double-free vulnerability in Apache's modhttp2 CVE-2026-23918. It's a nasty bug that hits the h2mplx.c stream cleanup path. Basically, if you time it right, you can get the server to try and clean up the same stream twice,...

8.8CVSS8AI score0.49727EPSS
SaveExploits18
Kitploit
Kitploit
added 2026/09/09 10:21 a.m.12 views

CVE-2026-23918-test

CVE-2026-23918-test This repository contains a Proof of Concept PoC demonstrating the Double Free vulnerability CVE-2026-23918 in Apache HTTP Server 2.4.66 modhttp2. The vulnerability stems from a race condition during early RSTSTREAM frame processing. I focused on the timing window where the...

8.8CVSS8AI score0.49727EPSS
SaveExploits18
Kitploit
Kitploit
added 2026/09/08 6:19 p.m.7 views

CVE-2026-23918-poc

CVE-2026-23918 — Apache modhttp2 Double Free Afectado: Apache HTTP Server 2.4.66 con modhttp2 + Event MPM Corregido en: Apache 2.4.67 modh2 v2.0.37 CVSS 3.1: 8.8 ALTA — Posible ejecución remota de código no autenticado CWE: CWE-415 Double Free ¿Cuál es la vulnerabilidad modhttp2 en Apache 2.4.66...

8.8CVSS8.2AI score0.49727EPSS
SaveExploits18
Kitploit
Kitploit
added 2026/09/07 8:31 p.m.4 views

http2-bomb

HTTP/2 Bomb - CVE-2026-49975 A denial-of-service DoS proof of concept targeting HTTP/2 servers. By combining HPACK amplification with stream retention, a single machine with a modest network connection can render a vulnerable server unavailable within seconds. Vulnerability CVE: CVE-2026-49975...

7.5CVSS7.4AI score0.34303EPSS
SaveExploits9
Tenable Nessus
Tenable Nessus
added 2026/08/30 12:00 a.m.14 views

MiracleLinux 9 : mod_http2-2.0.26-6.el9_8.2 (AXSA:2026-1693:03)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1693:03 advisory. httpd: modhttp2: Apache HTTP Server modhttp2: Use After Free vulnerability allows arbitrary code execution or denial of service. CVE-2026-48913 http...

7.3CVSS7.1AI score0.00545EPSS
SaveExploits0References3
Rockylinux
Rockylinux
added 2026/08/26 12:04 p.m.6 views

mod_http2 security, bug fix, and enhancement update

An update is available for modhttp2. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of...

7.3CVSS7.6AI score0.00545EPSS
SaveExploits0
OSV
OSV
added 2026/08/26 12:04 p.m.9 views

RLSA-2026:59387 Moderate: mod_http2 security, bug fix, and enhancement update

The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: httpd: modhttp2: Apache HTTP Server modhttp2: Use After Free vulnerability allows arbitrary code execution or denial of service. CVE-2026-48913 httpd: Apache HTTP Server:...

7.3CVSS7.6AI score0.00545EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/26 10:18 a.m.14 views

RHSA-2026:59387 Red Hat Security Advisory: mod_http2 security, bug fix, and enhancement update

Bulletin has no description...

7.3CVSS6.3AI score0.00545EPSS
SaveExploits0References12
Tenable Nessus
Tenable Nessus
added 2026/08/26 12:00 a.m.4 views

RockyLinux 9 : mod_http2 (RLSA-2026:59387)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:59387 advisory. httpd: modhttp2: Apache HTTP Server modhttp2: Use After Free vulnerability allows arbitrary code execution or denial of service. CVE-2026-48913 httpd:...

7.3CVSS7.4AI score0.00545EPSS
SaveExploits0References5
Tenable Nessus
Tenable Nessus
added 2026/08/26 12:00 a.m.8 views

AlmaLinux 9 : mod_http2 (ALSA-2026:59387)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:59387 advisory. httpd: modhttp2: Apache HTTP Server modhttp2: Use After Free vulnerability allows arbitrary code execution or denial of service. CVE-2026-48913 httpd:...

7.3CVSS7.4AI score0.00545EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
added 2026/08/26 12:00 a.m.6 views

Oracle Linux 9 : mod_http2 (ELSA-2026-59387)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-59387 advisory. 2.0.26-6.2 - Resolves: RHEL-190583 - address CVE-2026-43951 and CVE-2026-48913 in modhttp2 Tenable has extracted the preceding description block...

7.3CVSS7AI score0.00545EPSS
SaveExploits0References3
RedHat Linux
RedHat Linux
added 2026/08/25 2:42 p.m.9 views

httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service.

A flaw was found in the Apache HTTP Server's modhttp2 module. This vulnerability, known as a Use After Free, occurs when the server's file handles are exhausted. An attacker could potentially exploit this to cause a denial of service or, in some cases, execute arbitrary code, leading to system...

7.3CVSS7.5AI score0.00479EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2026/08/25 2:42 p.m.7 views

Moderate: Red Hat Security Advisory: mod_http2 security, bug fix, and enhancement update

An update for modhttp2 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

7.3CVSS7.6AI score0.00545EPSS
SaveExploits0References3
Oracle linux
Oracle linux
added 2026/08/25 12:00 a.m.8 views

mod_http2 security, bug fix, and enhancement update

2.0.26-6.2 - Resolves: RHEL-190583 - address CVE-2026-43951 and CVE-2026-48913 in modhttp2...

7.3CVSS6.8AI score0.00545EPSS
SaveExploits0
Tenable Nessus
Tenable Nessus
added 2026/08/25 12:00 a.m.4 views

RHEL 9 : mod_http2 (RHSA-2026:59387)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:59387 advisory. The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: httpd:...

7.3CVSS7.5AI score0.00545EPSS
SaveExploits0References7
Rows per page
Query Builder