Ò»¡¢Îó²î¸ÅÊö
Îó²îÃû³Æ | Apache mod_http2Ä£¿éË«ÖØÊÍ·ÅÎó²î |
CVE ID | CVE-2026-23918 |
Îó²îÀàÐÍ | ÄÚ´æÆÆËð | ·¢Ã÷ʱ¼ä | 2026-5-8 |
Îó²îÆÀ·Ö | 8.8 | Îó²îÆ·¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | µÍ |
ʹÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ²»ÐèÒª |
PoC/EXP | ÒѹûÕæ | ÔÚҰʹÓà | δ·¢Ã÷ |
Apache HTTP Server£¨Apache httpd£©ÊÇApache Software FoundationÐû²¼µÄ¿ªÔ´Web·þÎñÆ÷Èí¼þ£¬ÆÕ±éÓ¦ÓÃÓÚ»¥ÁªÍøÍøÕ¾¡¢ÆóÒµÃÅ»§¡¢API·þÎñ¼°ÔÆ»ù´¡ÉèÊ©³¡¾°¡£ÆäÖ§³ÖHTTP/1.1¡¢HTTP/2¡¢TLS¡¢·´Ïò´úÀí¼°Ä£¿é»¯À©Õ¹µÈ¹¦Ð§£¬¾ßÓи߼æÈÝÐÔ¡¢¸ßÎȹÌÐÔ¼°¸»ºñÉú̬£¬ÊÇÈ«ÇòʹÓÃ×îÆÕ±éµÄWeb·þÎñÆ÷Ö®Ò»¡£
2026Äê5ÔÂ8ÈÕ£¬×ðÁú¿¹ÙÍøÈë¿ÚÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄ£¨VSRC£©¼à²âµ½Apache mod_http2Ä£¿éË«ÖØÊÍ·ÅÎó²î¡£¸ÃÎó²îÓÉÓÚ·þÎñÆ÷ÔÚ´¦Öóͷ£HTTP/2ÅþÁ¬ÔçÆÚÖØÖã¨early reset£©ÇëÇóʱ£¬¶ÔÄÚ´æ×ÊÔ´ÊÍ·ÅÂß¼±£´æÈ±ÏÝ£¬µ¼ÖÂͳһÄڴ湤¾ß±»Öظ´ÊÍ·Å£¬½ø¶ø¿ÉÄÜÒý·¢ÄÚ´æÆÆËð¡£¹¥»÷Õß¿Éͨ¹ý½á¹¹¶ñÒâHTTP/2ÇëÇó´¥·¢Òì³£ÄÚ´æ²Ù×÷£¬Ôì³É·þÎñÍ߽⣬²¢ÔÚÌØ¶¨Ìõ¼þϽøÒ»²½ÊµÏÖÔ¶³Ì´úÂëÖ´ÐУ¨RCE£©¡£¸ÃÎó²î¿ÉÄܵ¼ÖÂWeb·þÎñ²»¿ÉÓᢷþÎñÆ÷ȨÏÞʧÏݼ°ÓªÒµÊý¾Ýй¶£¬½ø¶øÓ°ÏìÓªÒµÒ»Á¬ÐÔ¡£
¶þ¡¢Ó°Ïì¹æÄ£
Apache HTTP Server = 2.4.66
Èý¡¢Çå¾²²½·¥
3.1 Éý¼¶°æ±¾
¹Ù·½ÒÑÐû²¼ÐÞ¸´²¹¶¡£¬ÒÔÐÞ¸´¸ÃÎó²î¡£Apache HTTP Server >= 2.4.67
ÏÂÔØÁ´½Ó£ºhttps://httpd.apache.org/download.cgi/
3.2 ÔÝʱ²½·¥
ÔÝÎÞ¡£
3.3 ͨÓý¨Òé
? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬ïÔÌϵͳÎó²î£¬ÌáÉý·þÎñÆ÷µÄÇå¾²ÐÔ¡£? ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬Ð޸ķÀ»ðǽսÂÔ£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻò·þÎñ£¬ïÔ̽«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬ïÔ̹¥»÷Ãæ¡£? ʹÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£? ÔöǿϵͳÓû§ºÍȨÏÞ¹ÜÀí£¬ÆôÓöàÒòËØÈÏÖ¤»úÖÆºÍ×îСȨÏÞÔÔò£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏÞ¶È¡£? ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£
3.4 ²Î¿¼Á´½Ó
https://httpd.apache.org/security/vulnerabilities_24.html/https://www.openwall.com/lists/oss-security/2026/05/04/19/https://nvd.nist.gov/vuln/detail/CVE-2026-23918