Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely (thehackernews.com) 10
A critical flaw in Apache HTTP Server's HTTP/2 module could allow unauthenticated attackers to remotely execute code and potentially take control of affected server processes. Tracked as CVE-2026-119618, the vulnerability affects Apache HTTP Server 2.4.55 through 2.4.70 when HTTP/2 is enabled and is fixed in version 2.4.71. The Hacker News reports: The vendor's assessment, published yesterday, also says "public research has demonstrated a reliable exploit" against a server in its default configuration with mod_http2 enabled. It does not name or link that research. Security company Wiz said later that day that no exploit was available and that no exploitation in the wild had been reported.
HTTP/2 runs only where the Protocols directive turns it on, as the module documentation explains. The directive uses h2 for HTTP/2 over TLS and h2c for HTTP/2 over plain TCP. It can be set for the whole server or for a single virtual host, so admins should check the server-wide setting and every virtual host.
Standalone builds of the module, released on GitHub as mod_h2, are affected from version 2.0.8 through 2.0.42. Admins who run the Apache HTTP Server project's own releases should move to version 2.4.71, the fixed release named in its security advisory. That release also fixes a crash in mod_md, rated important, and a one-byte overwrite of stack memory in mod_vhost_alias, rated low.
HTTP/2 runs only where the Protocols directive turns it on, as the module documentation explains. The directive uses h2 for HTTP/2 over TLS and h2c for HTTP/2 over plain TCP. It can be set for the whole server or for a single virtual host, so admins should check the server-wide setting and every virtual host.
Standalone builds of the module, released on GitHub as mod_h2, are affected from version 2.0.8 through 2.0.42. Admins who run the Apache HTTP Server project's own releases should move to version 2.4.71, the fixed release named in its security advisory. That release also fixes a crash in mod_md, rated important, and a one-byte overwrite of stack memory in mod_vhost_alias, rated low.
Today I learned (Score:2, Troll)
Re: (Score:2)
Re: (Score:3)
Some of us haven't migrated from gopher yet.
Re: (Score:1)
Re: (Score:3)
Generally, LAMP still makes up a lot of the internet, nginx has taken a subset that is internet facing and needs nothing more than routing to an application of some description. However, Apache and mod_rewrite, mod_php, mod_perl etc is still very much alive and kicking.
I wouldn't say use Apache for everything, unless you need the features you can get from its modules then use something skinny, perhaps removing those modules is all you need, then you'll eventually have something closer to nginx anyhow :)
Re: (Score:2)
It's what I learned in the early '00s and that's what I'm sticking with!
Also, I don't load the mod_http2 module because I am an old man who yells at clouds.
now get off my lawn!
Re: (Score:2)
my web server is written in COBOL
Re: (Score:2)
We use Micro Focus's COBOL web server. I don't know what language the server is written in, but it does such a great job I've never had to hassle with it since we started using it twenty years ago. I even have Puppet scripts to setup new instances that have never been used except to create dev and QA environments. It just works.
Why can't we install and forget anything? (Score:1)
LOL I've had an old Apache running for random reasons and figured it is just static content and not even TLS.