Ò»¡¢·ì϶¸ÅÊö
·ìϼûû³Æ | Apache mod_http2Ä£¿éË«³Á¿ªÊÍ·ì϶ |
CVE ID | CVE-2026-23918 |
·ì϶ÀàÐÍ | ÄÚ´æ·ÛËé | ·¢ÏÖ¹¦·ò | 2026-5-8 |
·ì϶ÆÀ·Ö | 8.8 | ·ì϶µÈ¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | µÍ |
ÀûÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ²»±ØÒª |
PoC/EXP | Òѹ«¿ª | ÔÚÒ°ÀûÓà | δ·¢ÏÖ |
Apache HTTP Server£¨Apache httpd£©ÊÇApache Software Foundation°ä²¼µÄ¿ªÔ´Web·þÎñÆ÷Èí¼þ £¬¿í·ºÀûÓÃÓÚ»¥ÁªÍøÍøÕ¾¡¢ÆóÒµÃÅ»§¡¢API·þÎñ¼°ÔÆ»ù´¡ÉèÊ©³¡¾°¡£ÆäÖ§³ÖHTTP/1.1¡¢HTTP/2¡¢TLS¡¢·´Ïò´úÀí¼°Ä£¿é»¯À©´óµÈÖ°ÄÜ £¬ÓµÓи߼æÈÝÐÔ¡¢¸ß²»±äÐÔ¼°·á˶Éú̬ £¬ÊÇÈ«ÇòʹÓÃ×î¿í·ºµÄWeb·þÎñÆ÷Ö®Ò»¡£
2026Äê5ÔÂ8ÈÕ £¬±¦ÔËÀ³¹Ù·½ÍøÕ¾°²È«Ó¦¼±ÏìÓ¦ÖÐÐÄ£¨VSRC£©¼à²âµ½Apache mod_http2Ä£¿éË«³Á¿ªÊÍ·ì϶¡£¸Ã·ì϶ÓÉÓÚ·þÎñÆ÷ÔÚ´¦ÖÃHTTP/2ÏνÓÔçÆÚ³ÁÖã¨early reset£©ÒªÇóʱ £¬¶ÔÄÚ´æ×ÊÔ´¿ªÊÍÂß¼´æÔÚȱµã £¬µ¼ÖÂͳһÄÚ´æ¶ÔÏó±»³Á¸´¿ªÊÍ £¬½ø¶ø¿ÉÄÜÒý·¢ÄÚ´æ·ÛËé¡£¹¥»÷Õß¿Éͨ¹ý»ú¹Ø¶ñÒâHTTP/2ÒªÇó´¥·¢Òì³£ÄÚ´æ²Ù×÷ £¬Ôì³É·þÎñ±ÀÀ£ £¬²¢ÔÚÌض¨Ç°ÌáϽøÒ»²½ÊµÏÖÔ¶³Ì´úÂëÖ´ÐУ¨RCE£©¡£¸Ã·ì϶¿ÉÄܵ¼ÖÂWeb·þÎñ²»³ÉÓᢷþÎñÆ÷ȨÏÞʧÏݼ°ÒµÎñÊý¾Ýй¶ £¬½ø¶øÓ°ÏìÒµÎñ½ÐøÐÔ¡£
¶þ¡¢Ó°ÏìÁìÓò
Apache HTTP Server = 2.4.66
Èý¡¢°²È«´ëÊ©
3.1 Éý¼¶°æ±¾
¹Ù·½ÒÑ°ä²¼½¨¸´²¹¶¡ £¬ÒÔ½¨¸´¸Ã·ì϶¡£Apache HTTP Server >= 2.4.67
ÏÂÔØÁ´½Ó£ºhttps://httpd.apache.org/download.cgi/
3.2 һʱ´ëÊ©
ÔÝÎÞ¡£
3.3 ͨÓý¨Òé
? ¶¨ÆÚ¸üÐÂϵͳ²¹¶¡ £¬Ï÷¼õϵͳ·ì϶ £¬ÌáÉý·þÎñÆ÷µÄ°²È«ÐÔ¡£? ¼ÓǿϵͳºÍÍøÂçµÄ½Ó¼û½ÚÔì £¬Åú¸Ä·À»ðǽսÊõ £¬¹Ø¹Ø·Ç±ØÒªµÄÀûÓö˿ڻò·þÎñ £¬Ï÷¼õ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Â¶³öµ½¹«Íø £¬Ï÷¼õ¹¥»÷Ãæ¡£? ʹÓÃÆóÒµ¼¶°²È«²úÆ· £¬ÌáÉýÆóÒµµÄÍøÂ簲ȫ»úÄÜ¡£? ¼ÓǿϵͳÓû§ºÍȨÏÞÖÎÀí £¬ÆôÓöà³É·ÖÈÏÖ¤»úÔìºÍ×îÓ×ȨÏÞ×¼Ôò £¬Óû§ºÍÈí¼þȨÏÞӦά³ÖÔÚ×îµÍÏ޶ȡ£? ÆôÓÃÇ¿ÃÜÂëÕ½Êõ²¢ÉèÖÃΪ¶¨ÆÚÅú¸Ä¡£
3.4 ²Î¿¼Á´½Ó
https://httpd.apache.org/security/vulnerabilities_24.html/https://www.openwall.com/lists/oss-security/2026/05/04/19/https://nvd.nist.gov/vuln/detail/CVE-2026-23918
¾©¹«Íø°²±¸11010802024551ºÅ