Critical RCE Vulnerability in Apache HTTP Server

Patch looks like https://github.com/apache/httpd/commit/5ed39287660daacd1233c...

Appears to be the first issue ranked 'critical' since 2021. https://httpd.apache.org/security/vulnerabilities_24.html

I have a lot of Linux sysadmin experience but haven't touched Apache in more than a decade. I thought it's mostly nginx or other solutions at this point.

For anyone temporarily shutting off an Apache httpd, there's one step that's sometimes missed: a cron job or systemd timer for certbot. This can restart httpd and leave it running. In other words, in some common uses of Let's Encrypt, standard instructions such as "systemctl disable --now apache2" aren't sufficient to keep httpd off.

> in Apache HTTP Server’s HTTP/2 module (mod_http2)

I feel like in hindsight, HTTP/2 was a mistake. The theoretical benefits just don't justify the added complexity. It definitely shouldn't have been fasttracked like it was.

> What is CVE-2026-111497?

> CVE-2026-119618 is a critical, high-severity vulnerability involving....

two CVEs? (111497 != 11968)

Chances are most Apache/PHP installations run mpm_prefork and aren’t affected by this.

I don't understand what they mean by "51% of cloud environments" have a publicly exposed instance. What is a "cloud environment"? Do they mean a cloud hosting provider like AWS or Google? Are they saying that between those two only one of them has an instance of a vulnerable Apache server running?

duplicate of https://news.ycombinator.com/item?id=50453368

what is amazing, there are no apache updated containers / packages available yet.

everybody new Vulnerability makes me think how we are not so good a writing secure code?.

What is the benefit of using Apache over enjinx?

This took 7 minutes and $0.02 in deepseek spend through a subscription to reproduce. The prompt was simply directed at a vulnerable version and told to find a h2 race, which is generically the most common culprit these days. Once it found one, I had it attempt the same against a patched version (which failed).

Disabling h2 is the mitigation and is effective. The patch itself seems a little odd as a fix to me personally, but eh.

LiteSpeed and OpenLiteSpeed affected by this?

gno.security/repairer

>Due to improper synchronization when executing concurrent threads sharing resources, an attacker can trigger heap corruption.

>As of the time of this blog’s publication, no exploit is available and there are no reports of exploitation in the wild.

Since when does "memory corruption" = "RCE"? Last week I found and reproduced a memory corruption (a use-after-free) in PHP's runtime after running an on-premise agent for just 30 minutes. There's nothing about it on the internet. Should I write a blog post about a scary new vulnerability? :)

Why does it say the “vendor” for this is GitHub (for mod_h2)?

Is that just crappy LLM generated copy that is assuming that GitHub the company is responsible for that module because it’s hosted there?

From 2.4.55 through 2.4.70? Jokes on you, my version is not that new!

The C chansaw juggling doesn't get any safer from adding threads. Is the robust original (pre)fork configuration still supported?

This has not been a good month for the LAMP stack…

It's not always HTTP/2. But it's a pretty safe bet.

Even Apache is being filled with Claude commits, so great.....

all my handwritten sockets servers are fine because I use HTTP/1.1

I have 1 apache acting as a proxy for vhosts and

> a2dismod http2

gives me

> Module http2 already disabled

I don’t want to tempt fate (and hackers ) but I have dodged lots of major vulns this year with my strategy of writing code by hand instead of pip installing everything

only vuln I was exposed to was copy.fail, but that was a defense in depth weakness, and I was vulnerable to the kvm weakness if there was a malicious tenant in my host’s hypervisor, but that’s not fair I’m poor so I don’t have a dedi.

maybe the tcp vuln was the most exposed I’ve been but that was a very short window that got auto upgraded by apt with a high attack complexity

maybe I can write about how I survived 2026 without getting a supply chain vuln and get some work or students on new years? I feel that’ll be a pretty big accolade.

No CVSS severity level?

[flagged]

Time for a Rust based httpd replacement like https://xin.dev

HTTP2 is insecure and 1.1 is slow. At this point just find a good H3 implementation and drop the old protocols.

Wiz is such an amazing company. Israeli-based and recently acquired by Google, the significance of their security contributions cannot be overstated.

Another critical bug discovered by AI.

I want the rabidly AI-hating projects to stand their ground and refuse to fix vulnerabilities discovered with AI assistance.

[dead]