{"id":184237,"date":"2026-11-12T11:41:47","date_gmt":"2026-11-12T09:41:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-apache-httpd-zkspluatiruemaya-dlya-udalyonnogo-vypolneniya-koda-cherez-http-2"},"modified":"2026-11-12T11:41:52","modified_gmt":"2026-11-12T09:41:52","slug":"apache-httpd-vulnerability-exploited-for-remote-code-execution-via-http-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/apache-httpd-vulnerability-exploited-for-remote-code-execution-via-http-2","title":{"rendered":"A vulnerability in Apache httpd, exploited for remote code execution via HTTP\/2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The release of Apache HTTP Server 2.4.71 has been published, addressing a vulnerability (CVE-2026-119618) in the mod_http2 module, which has been assigned a critical threat level. This vulnerability allows for remote code execution on the server when sending a specially crafted request over the HTTP\/2 protocol. The vulnerability is present starting from Apache httpd versions 2.4.55 and also affects the standalone mod_h2 module distributed via GitHub. The status of vulnerability remediation in distributions can be assessed on the following pages: Debian, Ubuntu, SUSE, RHEL, Gentoo, Arch. \nFedora, FreeBSD.<\/p>\n
The issue is caused by a race condition when the function assign_headers() is called simultaneously from different threads, due to the processing of a shared structure (req->headers) instead of a separate copy for each thread (r->headers_in). If successfully exploited, an attacker could achieve memory modification outside of the allocated buffer. The vulnerability was simultaneously discovered by researchers from Anthropic and Google. The exploit has not yet been publicly released. As a workaround to block this vulnerability, it is sufficient to disable the processing of connections over the HTTP\/2 protocol in the httpd.conf configuration file using the directive \"Protocols http\/1.1\". <\/p>\n