A critical vulnerability, CVE-2026-119618, affects Apache HTTP Server versions 2.4.55 through 2.4.70 when the HTTP/2 module is enabled, potentially letting unauthenticated attackers remotely execute code. The Apache project's advisory says the flaw is fixed in version 2.4.71, which also patches an important mod_md crash bug and a low-severity stack overwrite in mod_vhost_alias. Standalone builds of the module (mod_h2) versions 2.0.8 through 2.0.42 are also affected.
apache.slashdot.org
· 2026-11-12
The Apache Software Foundation has released a fix for a critical flaw in the mod_http2 module of Apache HTTP Server, tracked as CVE-2026-119618. The bug, a race condition that can corrupt heap memory, affects HTTP Server versions 2.4.55 through 2.4.70 and standalone mod_h2 versions 2.0.8 through 2.0.42, and could let an unauthenticated attacker run arbitrary code with the web server's privileges. It was discovered by Anthropic's OSS Scanner and Google Cloud's Vulnerability Research team.
bleepingcomputer.com
· 2026-11-12
Security researchers at Anthropic and Google Cloud's Vulnerability Research Team independently discovered CVE-2026-119618, a critical race condition in Apache HTTP Server's mod_http2 module. The bug lies in the assign_headers() function, where improper synchronization during concurrent thread execution can corrupt heap memory, potentially letting an unauthenticated remote attacker execute arbitrary code. It affects Apache versions 2.4.55 through 2.4.70, with a fix available in 2.4.71.
wiz.io
· 2026-11-12
GoKawiil