EN PT-BR
← Voltar ao feed
critical

Apache HTTP Server 2.4.71 released to fix critical HTTP/2 RCE (CVE-2026-119618) and two other bugs

1 fonte(s) · 1 atualização(ões) · publicado 11/11/2026 11:32 · coletado há 1 hora

Apache HTTP Server 2.4.71 was released on 2026-11-11 to fix three security vulnerabilities, led by a critical race-condition in the HTTP/2 module that can lead to remote code execution (CVE-2026-119618). The vendor advisory says concurrent requests in mod_http2's assign_headers() can corrupt heap memory and allow arbitrary code execution; the flaw affects 2.4.55 through 2.4.70 and GitHub mod_h2 builds 2.0.8–2.0.42. Two additional flaws patched are a NULL dereference in mod_md (CVE-2026-106023) that crashes child processes, and a one-byte stack overwrite in mod_vhost_alias (CVE-2026-109163). There are no confirmed active exploits or public exploit code reported yet; administrators should update to 2.4.71 immediately or disable unused modules as a temporary mitigation (securityonline.info).

Entenda a falha

A vulnerabilidade

Apache HTTP Server 2.4.71 fixes three flaws. The most severe, CVE-2026-119618 (critical), is a race condition in mod_http2's assign_headers() that corrupts heap memory and can give a remote attacker arbitrary code execution. It affects 2.4.55 through 2.4.70 and GitHub mod_h2 builds 2.0.8 to 2.0.42. CVE-2026-106023 (important) is a NULL pointer dereference in mod_md that crashes a server child process, in 2.4.30 through 2.4.70. CVE-2026-109163 (low) is a one-byte stack buffer overwrite in mod_vhost_alias, in 2.4.69 and 2.4.70. All three are fixed in 2.4.71. The articles do not say whether authentication or a specific configuration is required.

Como funciona

For the critical bug, a remote client sends several HTTP/2 requests at the same time to a server with mod_http2 enabled. While handling them, mod_http2 runs assign_headers(), which touches a shared resource. The concurrent executions are not properly synchronized, so they interfere with each other and heap memory ends up corrupted. That corruption is what can lead to code execution. For mod_md, a NULL pointer is dereferenced during request handling, which crashes the child process. The articles give no further detail on the mod_vhost_alias path beyond a one-byte stack overwrite.

Por que é vulnerável

CVE-2026-119618 is classified as Concurrent Execution using Shared Resource with Improper Synchronization: assign_headers() lets concurrent requests use shared data without adequate locking or coordination. CVE-2026-106023 is a missing NULL check before a pointer is used in mod_md. CVE-2026-109163 is a one-byte stack buffer overwrite in mod_vhost_alias, which the article says appeared after the earlier CVE-2026-63292 patch. The articles do not describe the code changes in 2.4.71 or why these bugs went unnoticed.

Onde está

The critical flaw is in assign_headers() in the mod_http2 module; the other two are in the mod_md and mod_vhost_alias modules. The articles name no files or commits.

Como foi descoberta

The articles credit Anthropic's OSS Scanner, under ID ANT-2026-MAPKT6MZ, and Google Cloud analysts Anthony Weems and Simon Scannell with reporting the HTTP/2 bug. The reporters of the other two flaws are not named. The Apache project disclosed everything through its vendor advisory with the 2.4.71 release on 2026-11-11. The articles report no exploitation in the wild.

Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 12:27.

Detalhes técnicos

  • CVE-2026-119618 (described as Critical): a race condition in mod_http2 (assign_headers()) where "Concurrent Execution using Shared Resource with Improper Synchronization" can corrupt heap memory and enable remote code execution. Affects Apache HTTP Server 2.4.55–2.4.70 and GitHub mod_h2 builds 2.0.8–2.0.42 (securityonline.info).
  • CVE-2026-106023 (Important): a NULL pointer dereference in mod_md during request handling that can crash a server child process; reported to affect 2.4.30–2.4.70 (securityonline.info).
  • CVE-2026-109163 (Low): a one-byte stack buffer overwrite in mod_vhost_alias present in 2.4.69–2.4.70 (securityonline.info).
  • Reporters: Anthropic’s OSS Scanner (ANT-2026-MAPKT6MZ) and Google Cloud analysts Anthony Weems and Simon Scannell are credited with reporting the HTTP/2 bug (securityonline.info).

Detalhes da correção

  • All three issues were fixed in Apache HTTP Server 2.4.71; the article directs administrators to obtain the new build from the official Apache HTTP Server download page or wait for OS vendor packages (securityonline.info).

Remediação

  • Upgrade affected servers to Apache HTTP Server 2.4.71 immediately when possible. Use vendor packages from OS maintainers when they become available. If immediate patching is not feasible, disable mod_http2 and mod_md when they are not required as a temporary mitigation. Monitor vendor advisories and public sources for proof-of-concept code or reports of active exploitation (securityonline.info).

Linha do tempo

  1. securityonline.info ↗ · pub. 11/11/2026 11:32 · coletado 11/11 12:00 primeiro registro

    Apache HTTP Server 2.4.71 released to fix critical HTTP/2 RCE (CVE-2026-119618) and two other bugs

    ler a análise desta fonte

    Apache HTTP Server 2.4.71 was released on 2026-11-11 to fix three security vulnerabilities, led by a critical race-condition in the HTTP/2 module that can lead to remote code execution (CVE-2026-119618). The vendor advisory says concurrent requests in mod_http2's assign_headers() can corrupt heap memory and allow arbitrary code execution; the flaw affects 2.4.55 through 2.4.70 and GitHub mod_h2 builds 2.0.8–2.0.42. Two additional flaws patched are a NULL dereference in mod_md (CVE-2026-106023) that crashes child processes, and a one-byte stack overwrite in mod_vhost_alias (CVE-2026-109163). There are no confirmed active exploits or public exploit code reported yet; administrators should update to 2.4.71 immediately or disable unused modules as a temporary mitigation (securityonline.info).

    Technical Details

    • CVE-2026-119618 (described as Critical): a race condition in mod_http2 (assign_headers()) where "Concurrent Execution using Shared Resource with Improper Synchronization" can corrupt heap memory and enable remote code execution. Affects Apache HTTP Server 2.4.55–2.4.70 and GitHub mod_h2 builds 2.0.8–2.0.42 (securityonline.info).
    • CVE-2026-106023 (Important): a NULL pointer dereference in mod_md during request handling that can crash a server child process; reported to affect 2.4.30–2.4.70 (securityonline.info).
    • CVE-2026-109163 (Low): a one-byte stack buffer overwrite in mod_vhost_alias present in 2.4.69–2.4.70 (securityonline.info).
    • Reporters: Anthropic’s OSS Scanner (ANT-2026-MAPKT6MZ) and Google Cloud analysts Anthony Weems and Simon Scannell are credited with reporting the HTTP/2 bug (securityonline.info).

    Fix Details

    • All three issues were fixed in Apache HTTP Server 2.4.71; the article directs administrators to obtain the new build from the official Apache HTTP Server download page or wait for OS vendor packages (securityonline.info).

    Remediation

    • Upgrade affected servers to Apache HTTP Server 2.4.71 immediately when possible. Use vendor packages from OS maintainers when they become available. If immediate patching is not feasible, disable mod_http2 and mod_md when they are not required as a temporary mitigation. Monitor vendor advisories and public sources for proof-of-concept code or reports of active exploitation (securityonline.info).