EN PT-BR
← Voltar ao feed
critical technology

Apache HTTP Server 2.4.71 fixes critical unauthenticated HTTP/2 RCE (CVE-2026-119618) in mod_http2 and two other flaws

7 fonte(s) · 4 atualização(ões) · 3 repetição(ões) · publicado 11/11/2026 11:32 · coletado há 11 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 7 fontes trouxeram em 13/11/2026 00:01; os links antigos trazem para cá.

Fontes: bleepingcomputer.com ↗ cert.cyber.gouv.fr ↗ securityweek.com ↗ gbhackers.com ↗ thehackernews.com ↗ wiz.io ↗ securityonline.info ↗

On November 11, 2026 the Apache Software Foundation released Apache HTTP Server 2.4.71, which fixes three vulnerabilities. The most serious is CVE-2026-119618, a critical race condition in mod_http2 that can corrupt heap memory and lead to remote code execution (securityonline.info). Unauthenticated attackers with network access could take control of the server process on hosts with HTTP/2 enabled; the base Apache advisory rates it Critical, CVSS 9.8 (thehackernews.com). It affects Apache 2.4.55 through 2.4.70 and standalone mod_h2 builds 2.0.8 to 2.0.42. The other two fixes are CVE-2026-106023 in mod_md and CVE-2026-109163 in mod_vhost_alias. As of the latest sources (November 12), no verified public exploit or active exploitation has been reported. The French CERT (cert.cyber.gouv.fr) strongly urges users to update to 2.4.71.

Entenda a falha

A vulnerabilidade

CVE-2026-119618 (Critical) is a race condition in the assign_headers() function of mod_http2 in Apache HTTP Server 2.4.55 through 2.4.70, and in standalone mod_h2 builds 2.0.8 to 2.0.42. An unauthenticated attacker with network access to a server with HTTP/2 enabled (h2 or h2c in the Protocols directive) can corrupt heap memory and potentially run code with the web server process's privileges. Apache rates it Critical and Red Hat gives it CVSS 9.8, but Red Hat rates it Important on RHEL 9 and 10 because of its own mitigations. Fixed in 2.4.71; mod_h2 has no fix. CVE-2026-106023 (Important) is a NULL pointer dereference in mod_md (2.4.30-2.4.70) that crashes a child process. CVE-2026-109163 (Low) is a one-byte stack overwrite in mod_vhost_alias (2.4.69-2.4.70). CVE-2026-63292 appears only in the CERT-FR advisory, as an unspecified issue.

Como funciona

With HTTP/2 enabled, mod_http2 receives requests and handles the streams concurrently across threads. While building the request headers, assign_headers() works on a resource shared between those threads. When concurrent requests reach this code at the same time, the access is not properly synchronized, and the heap memory ends up corrupted. That corruption is what can later be turned into code execution inside the server process. Servers serving only HTTP/1.1 never take this path.

Por que é vulnerável

The root cause is missing or improper synchronization (CWE: concurrent execution using a shared resource with improper synchronization) in assign_headers(), so threads can touch the same shared data at once and damage heap memory. The articles do not explain why it went unnoticed since 2.4.55. Red Hat says its mod_http2 packages give each HTTP/2 stream its own memory allocator, which makes an attack much harder. The articles do not detail what the upstream fix changes beyond addressing the race in assign_headers(). For the other two bugs, the causes are a missing NULL check in mod_md and an off-by-one write in mod_vhost_alias, which followed an earlier CVE-2026-63292 patch.

Onde está

The flaw is in the assign_headers() function of mod_http2; gbhackers.com says Apache's advisory records the fix in commit 824beab9b9424d6cfb29595248fdbf6c3dddeab1. The other two are in the mod_md and mod_vhost_alias modules.

Como foi descoberta

Anthropic's OSS Scanner, a free AI-based scanning service for open-source projects, found the HTTP/2 flaw (ID ANT-2026-MAPKT6MZ) and reported it on October 26. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported the same bug independently on November 3 (The Hacker News says only 'last week'). The mod_md bug was reported on September 29 and the mod_vhost_alias one on October 5, each credited to several researchers listed by gbhackers.com. Apache published 2.4.71 on November 11, and no active exploitation was reported.

PoC pública

Sources conflict. SecurityWeek says a public PoC on GitHub reproduces memory corruption and Apache process crashes, but does not demonstrate remote code execution; the articles give no link to it. Red Hat's assessment claims public research showed a reliable exploit against a default configuration with mod_http2 enabled, without naming it. Wiz said on November 11 that no exploit was available, and no exploitation in the wild was reported. Treat it as urgent anyway: a crash-level PoC exists and a working RCE may follow.

Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 00:17.

Detalhes técnicos

  • CVE-2026-119618 (Critical): a race condition in the assign_headers() function of mod_http2, classed as concurrent execution using a shared resource with improper synchronization. It leads to heap corruption and possible remote code execution (securityonline.info, gbhackers.com). Exposure requires HTTP/2 to be enabled through the Protocols directive (thehackernews.com, gbhackers.com). No exploit chain or authentication is needed (gbhackers.com).
  • The standalone mod_h2 GitHub module (2.0.8 to 2.0.42) shares the flaw. Its repository is archived and no fix has been released for it (thehackernews.com).
  • CVE-2026-106023: a NULL pointer dereference in mod_md during request handling that can crash a server child process. It is reported to affect 2.4.30 to 2.4.70 (securityonline.info).
  • CVE-2026-109163 (Low): a one-byte stack buffer overwrite in mod_vhost_alias, present in 2.4.69 and 2.4.70 (securityonline.info, gbhackers.com).
  • Credit for the HTTP/2 bug goes to Anthropic's OSS Scanner (ANT-2026-MAPKT6MZ) and Google Cloud researchers Anthony Weems and Simon Scannell (securityonline.info, thehackernews.com).
  • gbhackers.com gives the report dates October 26, November 3, September 29 and October 5, without mapping each to a specific issue. It also cites fix commit 824beab9b9424d6cfb29595248fdbf6c3dddeab1.
  • Red Hat rates the flaw Important, not Critical, on RHEL 9 and 10 because of mitigations in its mod_http2 implementation (thehackernews.com).

Remediação

  • Upgrade to Apache HTTP Server 2.4.71 immediately, or install patched packages from OS vendors such as Red Hat and other Linux distributions (securityonline.info, thehackernews.com).
  • Temporary workaround: disable HTTP/2 by removing h2 and h2c from the Protocols directive (thehackernews.com). securityonline.info also suggests disabling mod_http2 and mod_md where they are not needed.
  • For standalone mod_h2 builds, no patch exists. Move to a fixed Apache release or disable the module (thehackernews.com).
  • Monitor for proof-of-concept code or exploitation reports. gbhackers.com notes that earlier Apache flaws have been actively exploited, so prompt patching is advised.

Relatos divergentes

  • Severity of CVE-2026-119618: the Apache advisory rates it Critical, CVSS 9.8, while Red Hat rates it Important on RHEL 9 and 10 (thehackernews.com). The Red Hat rating applies only to its own builds.
  • mod_md severity: securityonline.info labels CVE-2026-106023 Important, while gbhackers.com calls it high severity. The sources do not reconcile the labels.
  • Number of CVEs: cert.cyber.gouv.fr (November 12) lists a fourth identifier, CVE-2026-63292, described only as an unspecified security issue. The other sources cover three CVEs and do not mention it. This extra CVE is unconfirmed by them.
  • Exploitation: all sources report no confirmed exploitation. thehackernews.com also notes the lack of an available exploit despite public research claims.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 11/11/2026 21:00 · coletado 12/11 13:02

    Multiple critical vulnerabilities including remote code execution in Apache HTTP Server prior to 2.4.71

    ler a análise desta fonte

    Multiple security vulnerabilities have been identified in Apache HTTP Server versions prior to 2.4.71. These flaws include remote code execution, denial of service, and an unspecified security issue. The Apache Software Foundation released a security bulletin and the CHANGES_2.4.71 patch on November 11, 2026, addressing these vulnerabilities. Users of affected versions are strongly advised to update to version 2.4.71 to mitigate the risks. The vulnerabilities are tracked under CVE-2026-106023, CVE-2026-109163, CVE-2026-119618, and CVE-2026-63292.

  2. gbhackers.com ↗ · pub. 12/11/2026 02:50 · coletado 12/11 03:00

    Apache HTTP Server 2.4.71 fixes critical remote code execution vulnerability in mod_http2 and two additional bugs

    This report provides additional details on the discovery timelines, reporter credits, and specific vulnerable versions of Apache HTTP Server, plus the standalone mod_h2 GitHub releases. It clarifies the absence of exploit chains or authentication requirements, highlights the reported dates for each issue (October 26, November 3, September 29, October 5), and references the exact commit fixing the vulnerabilities (824beab9b9424d6cfb29595248fdbf6c3dddeab1). It also emphasizes that mod_http2 must be explicitly enabled for exposure and reminds that prior Apache vulnerabilities have seen active exploitation, underscoring the importance of timely patching.

    ler a análise desta fonte

    This report provides additional details on the discovery timelines, reporter credits, and specific vulnerable versions of Apache HTTP Server, plus the standalone mod_h2 GitHub releases. It clarifies the absence of exploit chains or authentication requirements, highlights the reported dates for each issue (October 26, November 3, September 29, October 5), and references the exact commit fixing the vulnerabilities (824beab9b9424d6cfb29595248fdbf6c3dddeab1). It also emphasizes that mod_http2 must be explicitly enabled for exposure and reminds that prior Apache vulnerabilities have seen active exploitation, underscoring the importance of timely patching.

    On November 11, 2026, the Apache Software Foundation released Apache HTTP Server 2.4.71 addressing three security vulnerabilities, including a critical remote code execution (RCE) flaw in the mod_http2 module (CVE-2026-119618). This vulnerability stems from a race condition causing heap corruption via concurrent execution without proper synchronization, affecting versions 2.4.55 through 2.4.70 and standalone mod_h2 builds from 2.0.8 to 2.0.42. Additional patches include a high severity NULL pointer dereference in mod_md (CVE-2026-106023) and a low severity one-byte stack buffer overwrite in mod_vhost_alias (CVE-2026-109163). The flaws were reported by Anthropic’s OSS Scanner and Google Cloud researchers, among others, with no current evidence of active exploitation. Administrators are urged to upgrade promptly to prevent potential critical impacts.

  3. thehackernews.com ↗ · pub. 12/11/2026 02:12 · coletado 12/11 03:00

    Critical Apache HTTP/2 Vulnerability (CVE-2026-119618) Allows Unauthenticated RCE on Servers with HTTP/2 Enabled

    This article adds details on Red Hat's assessment that its specific mod_http2 implementation mitigates the highest risk level, reducing the flaw severity rating to Important on RHEL 9/10, and clarifies the lack of available exploits despite public research claims. It also explains the exact configuration (Protocols directive) controlling HTTP/2 enablement and confirms the archived status of the mod_h2 standalone module without a fix. This context improves understanding of risk scope and interim mitigations.

    ler a análise desta fonte

    This article adds details on Red Hat's assessment that its specific mod_http2 implementation mitigates the highest risk level, reducing the flaw severity rating to Important on RHEL 9/10, and clarifies the lack of available exploits despite public research claims. It also explains the exact configuration (Protocols directive) controlling HTTP/2 enablement and confirms the archived status of the mod_h2 standalone module without a fix. This context improves understanding of risk scope and interim mitigations.

    A critical remote code execution vulnerability, CVE-2026-119618, exists in the Apache HTTP Server's HTTP/2 module mod_http2, affecting versions 2.4.55 through 2.4.70 and GitHub mod_h2 builds 2.0.8 to 2.0.42. The flaw allows unauthenticated attackers with network access to take full control of the server process where HTTP/2 is enabled. Red Hat rates the flaw as Important on their Enterprise Linux 9 and 10 distributions due to mitigations in their mod_http2 implementation, while the base Apache advisory rates it Critical with a 9.8 CVSS score. Fixes are included in Apache HTTP Server 2.4.71, released November 11, 2026. No verified public exploit or active exploitation has been reported yet. Admins are advised to update promptly or disable HTTP/2 support by removing the h2 and h2c protocols from the server's Protocols directive as a temporary mitigation until patching is possible.

    Technical Details

    The vulnerability stems from a race condition in the assign_headers() function of mod_http2, leading to heap memory corruption and remote code execution. The GitHub mod_h2 standalone module versions 2.0.8 through 2.0.42 share the vulnerability, though its repository has been archived with no patches released. The flaw impacts only servers with HTTP/2 enabled (via the Protocols directive).

    Fix Details

    Apache HTTP Server 2.4.71 addresses CVE-2026-119618 alongside two other security bugs: a crash in mod_md and a one-byte stack overwrite in mod_vhost_alias. Red Hat and other Linux distributions provide patched packages corresponding to this update. The issue was discovered by Anthropic's OSS Scanner and Google Cloud Vulnerability Researchers Anthony Weems and Simon Scannell.

    Remediation

    Administrators should update to Apache HTTP Server 2.4.71 immediately or apply vendor-provided OS packages. Where updating is infeasible, removing h2 and h2c from Protocols to disable HTTP/2 is recommended as a temporary workaround. Continuous monitoring for proof-of-concept or active exploits is advised.

  4. securityonline.info ↗ · pub. 11/11/2026 11:32 · coletado 11/11 12:00 primeiro registro

    Apache HTTP Server 2.4.71 released to fix critical HTTP/2 RCE (CVE-2026-119618) and two other bugs

    ler a análise desta fonte

    Apache HTTP Server 2.4.71 was released on 2026-11-11 to fix three security vulnerabilities, led by a critical race-condition in the HTTP/2 module that can lead to remote code execution (CVE-2026-119618). The vendor advisory says concurrent requests in mod_http2's assign_headers() can corrupt heap memory and allow arbitrary code execution; the flaw affects 2.4.55 through 2.4.70 and GitHub mod_h2 builds 2.0.8–2.0.42. Two additional flaws patched are a NULL dereference in mod_md (CVE-2026-106023) that crashes child processes, and a one-byte stack overwrite in mod_vhost_alias (CVE-2026-109163). There are no confirmed active exploits or public exploit code reported yet; administrators should update to 2.4.71 immediately or disable unused modules as a temporary mitigation (securityonline.info).

    Technical Details

    • CVE-2026-119618 (described as Critical): a race condition in mod_http2 (assign_headers()) where "Concurrent Execution using Shared Resource with Improper Synchronization" can corrupt heap memory and enable remote code execution. Affects Apache HTTP Server 2.4.55–2.4.70 and GitHub mod_h2 builds 2.0.8–2.0.42 (securityonline.info).
    • CVE-2026-106023 (Important): a NULL pointer dereference in mod_md during request handling that can crash a server child process; reported to affect 2.4.30–2.4.70 (securityonline.info).
    • CVE-2026-109163 (Low): a one-byte stack buffer overwrite in mod_vhost_alias present in 2.4.69–2.4.70 (securityonline.info).
    • Reporters: Anthropic’s OSS Scanner (ANT-2026-MAPKT6MZ) and Google Cloud analysts Anthony Weems and Simon Scannell are credited with reporting the HTTP/2 bug (securityonline.info).

    Fix Details

    • All three issues were fixed in Apache HTTP Server 2.4.71; the article directs administrators to obtain the new build from the official Apache HTTP Server download page or wait for OS vendor packages (securityonline.info).

    Remediation

    • Upgrade affected servers to Apache HTTP Server 2.4.71 immediately when possible. Use vendor packages from OS maintainers when they become available. If immediate patching is not feasible, disable mod_http2 and mod_md when they are not required as a temporary mitigation. Monitor vendor advisories and public sources for proof-of-concept code or reports of active exploitation (securityonline.info).

Repetiram sem novidade