{"id":184237,"date":"2026-11-12T11:41:47","date_gmt":"2026-11-12T09:41:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-apache-httpd-zkspluatiruemaya-dlya-udalyonnogo-vypolneniya-koda-cherez-http-2"},"modified":"2026-11-12T11:41:52","modified_gmt":"2026-11-12T09:41:52","slug":"apache-httpd-vulnerability-exploited-for-remote-code-execution-via-http-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/apache-httpd-vulnerability-exploited-for-remote-code-execution-via-http-2","title":{"rendered":"Haavatavus Apache httpd-s, mida kasutatakse kaugkoodide teostamiseks HTTP\/2 kaudu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avalikustatud on Apache HTTP serveri 2.4.71 versioon, milles on k\u00f5rvaldatud haavatavus (CVE-2026-119618) mod_http2 moodulis, millele on m\u00e4\u00e4ratud kriitiline ohuaste. Haavatavus v\u00f5imaldab kaugt\u00e4itmist koodi serveris, kui saadetakse spetsiaalselt vormindatud p\u00e4ring HTTP\/2 protokolli kaudu. Haavatavus ilmneb alates Apache httpd versioonidest 2.4.55 ja see m\u00f5jutab ka eraldi mod_h2 moodulit, mille levitamine toimub GitHub'i kaudu. Haavatavuste k\u00f5rvaldamise staatust distributsioonides saab hinnata j\u00e4rgmistel lehtedel: Debian, Ubuntu, SUSE, RHEL, Gentoo, Arch,
\nFedora, FreeBSD.<\/p>\n

Probleem tuleneb v\u00f5idus\u00f5idutingimustest, kui funktsiooni assign_headers() kutsutakse samaaegselt v\u00e4lja erinevatest l\u00f5imudest. See juhtub, kuna funktsioon t\u00f6\u00f6tleb k\u00f5igi l\u00f5imude jaoks \u00fchist struktuuri (req->headers), mitte iga l\u00f5ime jaoks eraldi kopeeritud struktuuri (r->headers_in). Kui r\u00fcnnak on edukas, v\u00f5ib r\u00fcndaja saavutada m\u00e4lumuutuse v\u00e4ljaspool eraldatud m\u00e4lupuhvrit. Haavatavus tuvastati ligikaudu samaaegselt Anthropic ja Google'i teadlaste poolt. Eksploiti ei ole veel avalikult avaldatud. Haavatavuse blokeerimiseks piisab, kui keelata HTTP\/2 protokolli t\u00f6\u00f6tlemine konfiguratsioonifailis httpd.conf, kasutades direktiivi \u00abProtocols http\/1.1\u00bb. <\/p>\n

Septembri Netcrafti aruande kohaselt t\u00f6\u00f6tab Apache httpd all umbes 170 miljonit veebisaiti (11.56%). Millistel neist kasutatakse HTTP\/2, ei ole teavet.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.71, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-119618) \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 mod_http2, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0443 HTTP\/2. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0439 Apache httpd 2.4.55 \u0438 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u043c\u043e\u0434\u0443\u043b\u044c mod_h2, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0439 \u0447\u0435\u0440\u0435\u0437 GitHub. \u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184237","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus Apache httpd-s, mida saab \u00e4ra kasutada koodi kaugt\u00e4itmiseks HTTP\/2 kaudu | ProHoster","description":"Avalikustatud on Apache HTTP serveri 2.4.71 versioon, milles on k\u00f5rvaldatud haavatavus (CVE-2026-119618) mod_http2 moodulis, millele on m\u00e4\u00e4ratud kriitiline ohuaste.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/apache-httpd-vulnerability-exploited-for-remote-code-execution-via-http-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache httpd, \u0437\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 HTTP\/2 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.71, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-119618) \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 mod_http2, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/apache-httpd-vulnerability-exploited-for-remote-code-execution-via-http-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-11-12T09:41:47+00:00","article:modified_time":"2026-11-12T09:41:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/184237","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=184237"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/184237\/revisions"}],"predecessor-version":[{"id":184238,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/184237\/revisions\/184238"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=184237"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=184237"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=184237"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}