Ò»¡¢·ì϶¸ÅÊö
·ì϶Ãû³Æ | Apache mod_http2Ä£¿éË«ÖØ¿ªÊÍ·ì϶ |
CVE ID | CVE-2026-23918 |
·ì϶ÀàÐÍ | ÄÚ´æ·ÛËé | ·¢ÏÖ¹¦·ò | 2026-5-8 |
·ì϶ÆÀ·Ö | 8.8 | ·ì϶µÈ¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | µÍ |
ÀûÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ²»±ØÒª |
PoC/EXP | Òѹ«¿ª | ÔÚÒ°ÀûÓà | δ·¢ÏÖ |
Apache HTTP Server£¨Apache httpd£©ÊÇApache Software Foundation°ä²¼µÄ¿ªÔ´Web·þÎñÆ÷Èí¼þ£¬£¬¿í·ºÀûÓÃÓÚ»¥ÁªÍøÍøÕ¾¡¢ÆóÒµÃÅ»§¡¢API·þÎñ¼°ÔÆ»ù´¡ÉèÊ©³¡¾°¡£¡£ÆäÖ§³ÖHTTP/1.1¡¢HTTP/2¡¢TLS¡¢·´Ïò´úÀí¼°Ä£¿é»¯À©´óµÈÖ°ÄÜ£¬£¬ÓµÓи߼æÈÝÐÔ¡¢¸ß²»±äÐÔ¼°·á˶Éú̬£¬£¬ÊÇÈ«ÇòʹÓÃ×î¿í·ºµÄWeb·þÎñÆ÷Ö®Ò»¡£¡£
2026Äê5ÔÂ8ÈÕ£¬£¬OG¶«·½Ìü°²È«Ó¦¼±ÏìÓ¦ÖÐÐÄ£¨VSRC£©¼à²âµ½Apache mod_http2Ä£¿éË«ÖØ¿ªÊÍ·ì϶¡£¡£¸Ã·ì϶ÓÉÓÚ·þÎñÆ÷ÔÚ´¦ÖÃHTTP/2ÏνÓÔçÆÚÖØÖã¨early reset£©ÒªÇóʱ£¬£¬¶ÔÄÚ´æ×ÊÔ´¿ªÊÍÂß¼´æÔÚȱµã£¬£¬µ¼ÖÂͳһÄÚ´æ¶ÔÏó±»·´¸´¿ªÊÍ£¬£¬½ø¶ø¿ÉÄÜÒý·¢ÄÚ´æ·ÛËé¡£¡£¹¥»÷Õß¿Éͨ¹ý»ú¹Ø¶ñÒâHTTP/2ÒªÇó´¥·¢Òì³£ÄÚ´æ²Ù×÷£¬£¬Ôì³É·þÎñ±ÀÀ££¬£¬²¢ÔÚÌض¨Ç°ÌáϽøÒ»²½ÊµÏÖÔ¶³Ì´úÂëÖ´ÐУ¨RCE£©¡£¡£¸Ã·ì϶¿ÉÄܵ¼ÖÂWeb·þÎñ²»³ÉÓᢷþÎñÆ÷ȨÏÞʧÏݼ°ÒµÎñÊý¾Ýй¶£¬£¬½ø¶øÓ°ÏìÒµÎñ½ÐøÐÔ¡£¡£
¶þ¡¢Ó°ÏìÁìÓò
Apache HTTP Server = 2.4.66
Èý¡¢°²È«´ëÊ©
3.1 Éý¼¶°æ±¾
¹Ù·½ÒÑ°ä²¼ÐÞ¸´²¹¶¡£¬£¬ÒÔÐÞ¸´¸Ã·ì϶¡£¡£Apache HTTP Server >= 2.4.67
ÏÂÔØÁ´½Ó£ºhttps://httpd.apache.org/download.cgi/
3.2 һʱ´ëÊ©
ÔÝÎÞ¡£¡£
3.3 ͨÓý¨Òé
? ¶¨ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬Ï÷¼õϵͳ·ì϶£¬£¬ÌáÉý·þÎñÆ÷µÄ°²È«ÐÔ¡£¡£? ¼ÓǿϵͳºÍÍøÂçµÄ½Ó¼û½ÚÖÆ£¬£¬Åú¸Ä·À»ðǽսÊõ£¬£¬¹Ø±Õ·Ç±ØÒªµÄÀûÓö˿ڻò·þÎñ£¬£¬Ï÷¼õ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Â¶³öµ½¹«Íø£¬£¬Ï÷¼õ¹¥»÷Ãæ¡£¡£? ʹÓÃÆóÒµ¼¶°²È«²úÆ·£¬£¬ÌáÉýÆóÒµµÄÍøÂ簲ȫ»úÄÜ¡£¡£? ¼ÓǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬ÆôÓöà³É·ÖÈÏÖ¤»úÖƺÍ×îСȨÏÞ×¼Ôò£¬£¬Óû§ºÍÈí¼þȨÏÞӦά³ÖÔÚ×îµÍÏ޶ȡ£¡£? ÆôÓÃÇ¿ÃÜÂëÕ½Êõ²¢ÉèÖÃΪ¶¨ÆÚÅú¸Ä¡£¡£
3.4 ²Î¿¼Á´½Ó
https://httpd.apache.org/security/vulnerabilities_24.html/https://www.openwall.com/lists/oss-security/2026/05/04/19/https://nvd.nist.gov/vuln/detail/CVE-2026-23918
¾©¹«Íø°²±¸11010802024551ºÅ