Apache — PoC Archivehttps://poc.intelseclab.com/tags/apache/Latest proof-of-concept entries.Hugoen-usSun, 16 Aug 2026 00:00:00 +0000Apache Traffic Server Internal @Header Metadata Spoofing (CVE-2026-33267)https://poc.intelseclab.com/pocs/web/2026-08-16_cve-2026-33267-apache-trafficserver-header-spoof/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-16_cve-2026-33267-apache-trafficserver-header-spoof/Critical severity (CVSS 10) — web · CVE-2026-33267 / GHSA-jrh6-9hgv-mqm7. Status: Patched (9.2.15 / 10.1.4). Affects: Apache Traffic Server. Tags: apache, traffic-server, ats, header-injection, metadata-spoof, cache-poisoning, acl-bypass, plugin, CVE-2026-33267.webCriticalapachetraffic-serveratsheader-injectionmetadata-spoofcache-poisoningacl-bypasspluginCVE-2026-33267Apache mod_ssl TLS 1.3 Session Resumption Client Certificate Bypass (CVE-2025-23048)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-23048-apache-tls13-session-resumption-client-cert-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-23048-apache-tls13-session-resumption-client-cert-bypass/Critical severity (CVSS 9.1) — web · CVE-2025-23048. Status: PoC. Affects: Apache HTTP Server (mod_ssl). Tags: apache, mod_ssl, httpd, tls1.3, session-resumption, client-certificate, authentication-bypass, cwe-295, openssl.webCriticalapachemod_sslhttpdtls1.3session-resumptionclient-certificateauthentication-bypasscwe-295opensslApache HTTP Server mod_auth_digest Timing Attack — CVE-2026-33006https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33006-apache-mod-auth-digest-timing/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33006-apache-mod-auth-digest-timing/Medium severity (CVSS 4.8) — web · CVE-2026-33006. Status: PoC. Affects: Apache HTTP Server (mod_auth_digest module). Tags: apache, mod_auth_digest, timing-attack, authentication-bypass, digest-auth, http, side-channel.webMediumapachemod_auth_digesttiming-attackauthentication-bypassdigest-authhttpside-channelApache HTTP Server HTTP/2 HPACK Cookie-Merging Memory Bomb (CVE-2026-49975)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-49975-apache-http2-cookie-bomb-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-49975-apache-http2-cookie-bomb-dos/High severity — network · CVE-2026-49975. Status: PoC. Affects: Apache HTTP Server (mod_http2). Tags: apache, httpd, http2, hpack, mod_http2, cookie-header, memory-exhaustion, denial-of-service, flow-control.networkHighapachehttpdhttp2hpackmod_http2cookie-headermemory-exhaustiondenial-of-serviceflow-controlApache httpd mod_http2 Double-Free Pre-Auth RCE - CVE-2026-23918https://poc.intelseclab.com/pocs/web/2026-05-17_apache-httpd-mod-http2-double-free/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_apache-httpd-mod-http2-double-free/Critical severity — web · CVE-2026-23918. Status: Weaponized. Affects: Apache HTTP Server (httpd) with mod_http2. Tags: RCE, pre-auth, unauthenticated, double-free, heap-corruption, Apache, httpd, mod_http2, HTTP/2, TLS.webCriticalRCEpre-authunauthenticateddouble-freeheap-corruptionApachehttpdmod_http2HTTP/2TLS