mod-http2

Here are 4 public repositories matching this topic...

googlesky / CVE-2026-119618

Apache httpd mod_http2 (2.4.55-2.4.70) races on the connection allocator when assign_headers() writes the synthesised Content-Length: 0 into the shared stream table, corrupting the child heap. Containerised lab, stdlib HTTP/2 PoC, ASan and TSan evidence, 2.4.71 differential, workaround test, 0day sweep.

proof-of-concept http2 poc apache-httpd memory-corruption addresssanitizer security-research vulnerability-research remote-code-execution race-condition cwe-362 heap-corruption containerized-lab cve-2026-119618 mod-http2

Updated Nov 12, 2026
Python

d4ytox / CVE-2026-119618

Star

Unauthenticated remote heap corruption in Apache httpd mod_http2 (2.4.55-2.4.70; fixed 2.4.71): a race in assign_headers() writes a synthesised Content-Length into the stream table the connection thread owns. Differential lab builds vulnerable and fixed side by side and measures the crash rate against zero. DoS demonstrated, not RCE.

python proof-of-concept exploit http2 cybersecurity infosec pentesting apache-httpd denial-of-service apriori-algorithm memory-corruption addresssanitizer unauthenticated redteam race-condition cwe-362 heap-corruption cve-2026-119618 mod-http2

Updated Nov 14, 2026
Python

foxcornlab / apache-httpd-scanner

Star

Detection-only triage for Apache HTTP Server 2.4.71 batch: CVE-2026-119618 (mod_http2 RCE, CVSS 9.8), CVE-2026-106023, CVE-2026-109163. Grades httpd versions, catches the distro-backport and mod_h2 traps.

http2 detection apache httpd vulnerability-scanner security-triage apache-http-server cve-2026-119618 mod-http2

Updated Nov 12, 2026
Python

LLCForge / CVE-2026-119618

Star

Weaponised PoC driver for CVE-2026-119618, the mod_http2 assign_headers() race: header-table shaping, allocator free-list priming, controlled heap overlap and a forged apr_table_entry_t layout with an RCE roadmap. httpd 2.4.55-2.4.70, stdlib-only.

python proof-of-concept http2 apache httpd cve security-research vulnerability-research cve-2026-119618 mod-http2

Updated Nov 12, 2026
Python

Add this topic to your repo

To associate your repository with the mod-http2 topic, visit your repo's landing page and select "manage topics."

Learn more