{"id":184237,"date":"2026-11-12T11:41:47","date_gmt":"2026-11-12T09:41:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-apache-httpd-zkspluatiruemaya-dlya-udalyonnogo-vypolneniya-koda-cherez-http-2"},"modified":"2026-11-12T11:41:52","modified_gmt":"2026-11-12T09:41:52","slug":"apache-httpd-vulnerability-exploited-for-remote-code-execution-via-http-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/apache-httpd-vulnerability-exploited-for-remote-code-execution-via-http-2","title":{"rendered":"Vuln\u00e9rabilit\u00e9 dans Apache httpd, exploit\u00e9e pour l'ex\u00e9cution distante de code via HTTP\/2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

La version 2.4.71 du serveur HTTP Apache a \u00e9t\u00e9 publi\u00e9e, corrigeant une vuln\u00e9rabilit\u00e9 (CVE-2026-119618) dans le module mod_http2, class\u00e9e comme critique. Cette vuln\u00e9rabilit\u00e9 permet l'ex\u00e9cution de code \u00e0 distance sur le serveur via l'envoi d'une requ\u00eate sp\u00e9cialement format\u00e9e par le protocole HTTP\/2. Elle affecte les versions Apache httpd \u00e0 partir de 2.4.55 et touche \u00e9galement le module mod_h2, disponible sur GitHub. L'\u00e9tat des correctifs pour les distributions peut \u00eatre \u00e9valu\u00e9 sur ces pages : Debian, Ubuntu, SUSE, RHEL, Gentoo, Arch.
\nFedora, FreeBSD.<\/p>\n

Le probl\u00e8me est caus\u00e9 par une condition de concurrence lors de l'appel simultan\u00e9 de la fonction assign_headers() depuis diff\u00e9rents threads, r\u00e9sultant du traitement par une structure commune \u00e0 tous les threads (req->headers), plut\u00f4t que d'une copie s\u00e9par\u00e9e pour chaque thread (r->headers_in). En cas d'exploitation r\u00e9ussie, l'attaquant peut modifier la m\u00e9moire en dehors du tampon allou\u00e9. La vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e \u00e0 peu pr\u00e8s \u00e0 la m\u00eame p\u00e9riode par des chercheurs d'Anthropic et de Google. L'exploit n'a pas encore \u00e9t\u00e9 publi\u00e9 publiquement. Comme solution de contournement pour bloquer la vuln\u00e9rabilit\u00e9, il suffit de d\u00e9sactiver le traitement des connexions via le protocole HTTP\/2 dans le fichier de configuration httpd.conf gr\u00e2ce \u00e0 la directive \u00abProtocols http\/1.1\u00bb. <\/p>\n

Selon le rapport de septembre de la soci\u00e9t\u00e9 Netcraft, environ 170 millions de sites (11,56 %) fonctionnent sous Apache httpd. Aucune information n'est fournie sur ceux qui utilisent HTTP\/2.
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.71, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-119618) \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 mod_http2, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0443 HTTP\/2. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0439 Apache httpd 2.4.55 \u0438 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u043c\u043e\u0434\u0443\u043b\u044c mod_h2, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0439 \u0447\u0435\u0440\u0435\u0437 GitHub. \u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184237","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vuln\u00e9rabilit\u00e9 dans Apache httpd, exploit\u00e9e pour ex\u00e9cuter du code \u00e0 distance via HTTP\/2 | ProHoster","description":"La version 2.4.71 du serveur HTTP Apache a \u00e9t\u00e9 publi\u00e9e, corrigeant une vuln\u00e9rabilit\u00e9 (CVE-2026-119618) dans le module mod_http2, class\u00e9e comme critique.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/apache-httpd-vulnerability-exploited-for-remote-code-execution-via-http-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache httpd, \u0437\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 HTTP\/2 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.71, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-119618) \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 mod_http2, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/apache-httpd-vulnerability-exploited-for-remote-code-execution-via-http-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-11-12T09:41:47+00:00","article:modified_time":"2026-11-12T09:41:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/184237","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=184237"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/184237\/revisions"}],"predecessor-version":[{"id":184238,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/184237\/revisions\/184238"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=184237"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=184237"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=184237"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}