Huo Xing Cai Jing reports a critical security vulnerability in the open-source server software Apache HTTP Server. Attackers with access to affected services can craft requests to corrupt server memory and execute code with the privileges of the web service process. The vulnerability resides in the HTTP/2 module, allowing unauthenticated attackers to trigger a concurrency synchronization flaw that results in heap memory corruption; successful exploitation enables code execution with the privileges of Apache worker processes and access to data readable by those processes. Affected versions include Apache HTTP Server 2.4.55 through 2.4.70, and mod_h2 versions 2.0.8 through 2.0.42 obtained separately from GitHub. Red Hat states that the risk applies to servers enabling HTTP/2 via the Protocols directive, including H2 for encrypted connections and H2C for plaintext connections. Administrators must inspect both global configurations and individual virtual host configurations; if a website uses a CDN or reverse proxy in front of Apache, it is also necessary to verify whether the Apache origin server is directly accessible via HTTP/2. Apache released HTTP Server 2.4.71 on November 11, 2026, and recommends that all websites using Apache upgrade immediately. If an immediate upgrade is not possible, HTTP/2 should be temporarily disabled. The issue lies in the assign_headers() function within mod_http2. HTTP/2 allows multiple requests to be processed concurrently over a single connection; the affected code contains a synchronization flaw when handling shared resources, potentially leading to heap memory corruption. The vulnerability was discovered by the Anthropic OSS Scanner open-source project and the Google Cloud Vulnerability Research Team. Anthropic reported the issue to the Apache Foundation on October 26, and the Google Cloud team reported the same vulnerability on November 3.
Apache HTTP Server 2.4.55–2.4.70 found with critical HTTP/2 remote code execution vulnerability
MarsBitShare
Summary
A new vulnerability has been reported for the Apache HTTP Server, revealing a critical HTTP/2 remote code execution flaw. The security issue affects versions 2.4.55 to 2.4.70 and mod_h2 2.0.8 to 2.0.42. Attackers can exploit this vulnerability by sending specially crafted requests to corrupt server memory and execute arbitrary code. Apache released version 2.4.71 on November 11, 2026, to address this issue. System administrators are strongly advised to upgrade immediately or disable HTTP/2 as a temporary mitigation.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.