{"id":184237,"date":"2026-11-12T11:41:47","date_gmt":"2026-11-12T09:41:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-apache-httpd-zkspluatiruemaya-dlya-udalyonnogo-vypolneniya-koda-cherez-http-2"},"modified":"2026-11-12T11:41:52","modified_gmt":"2026-11-12T09:41:52","slug":"apache-httpd-vulnerability-exploited-for-remote-code-execution-via-http-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/apache-httpd-vulnerability-exploited-for-remote-code-execution-via-http-2","title":{"rendered":"Vulnerability in Apache httpd, exploited for remote code execution via HTTP\/2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Objavljen je izdanje HTTP poslu\u017eitelja Apache 2.4.71, u kojem je otklonjena ranjivost (CVE-2026-119618) u modulu mod_http2, kojem je dodijeljen kriti\u010dan nivo opasnosti. Ranjivost omogu\u0107ava udaljeno izvr\u0161avanje vlastitog koda na poslu\u017eitelju prilikom slanja posebno oblikovanog zahtjeva putem protokola HTTP\/2. Ranjivost se pojavljuje od verzija Apache httpd 2.4.55 i tako\u0111e zahvata poseban modul mod_h2, distribuiran putem GitHub-a. Status otklanjanja ranjivosti u distribucijama mo\u017ee se procijeniti na ovim stranicama: Debian, Ubuntu, SUSE, RHEL, Gentoo, Arch.
\nFedora, FreeBSD.<\/p>\n

Te\u017eava je posledica stanja tekme pri hkratnem klicu funkcije assign_headers() iz razli\u010dnih niti, kar nastane zaradi obdelave s skupno strukturo za vse niti (req->headers), namesto da bi imeli lo\u010deno kopijo za vsako nit (r->headers_in). Ob uspe\u0161ni zlorabi lahko napadalec spremeni spomin izven dodeljene pomnilni\u0161ke meje. Ranljivost je pribli\u017eno isto\u010dasno odkrila raziskovalna skupina iz podjetij Anthropic in Google. Eksploit \u0161e ni bil javno objavljen. Kot obvoz za blokado ranljivosti je dovolj, da v datoteki httpd.conf onemogo\u010dite obdelavo povezav preko protokola HTTP\/2 z uporabo direktive \u201eProtocols http\/1.1\u201c. <\/p>\n

Prema septembarskom izvje\u0161taju kompanije Netcraft, pod upravom Apache httpd radi oko 170 miliona sajtova (11.56%). Na kojima se koristi HTTP\/2 nije navedeno.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.71, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-119618) \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 mod_http2, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0443 HTTP\/2. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0439 Apache httpd 2.4.55 \u0438 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 \u043c\u043e\u0434\u0443\u043b\u044c mod_h2, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0439 \u0447\u0435\u0440\u0435\u0437 GitHub. \u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184237","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranjivost u Apache httpd, iskori\u0161tavana za udaljeno izvr\u0161avanje koda putem HTTP\/2 | ProHoster","description":"Objavljen je izdanje HTTP poslu\u017eitelja Apache 2.4.71, u kojem je otklonjena ranjivost (CVE-2026-119618) u modulu mod_http2, kojem je dodijeljen kriti\u010dan nivo opasnosti.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/apache-httpd-vulnerability-exploited-for-remote-code-execution-via-http-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache httpd, \u0437\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 HTTP\/2 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.71, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-119618) \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 mod_http2, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/apache-httpd-vulnerability-exploited-for-remote-code-execution-via-http-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-11-12T09:41:47+00:00","article:modified_time":"2026-11-12T09:41:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/184237","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=184237"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/184237\/revisions"}],"predecessor-version":[{"id":184238,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/184237\/revisions\/184238"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=184237"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=184237"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=184237"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}