Apache HTTP Server 2.4.55-2.4.70 phát hiện với lỗ hổng thực thi mã từ xa HTTP/2 nghiêm trọng

The Huoxing Finance report states that a critical security vulnerability has been discovered in the open-source server software Apache HTTP Server. Attackers with access to affected services can craft requests to corrupt server memory and execute code with the privileges of the web service process. This vulnerability resides in the HTTP/2 module, allowing attackers to trigger a concurrency synchronization flaw without authentication, resulting in heap memory corruption. Successful exploitation enables code execution with the privileges of the Apache worker process and access to data readable by that process. Affected versions include Apache HTTP Server 2.4.55 through 2.4.70, as well as mod_h2 versions 2.0.8 through 2.0.42 obtained separately from GitHub. Red Hat notes that the risk applies to servers with HTTP/2 enabled via the Protocols directive, including H2 for encrypted connections and H2C for plaintext connections. Administrators must inspect both global configurations and individual virtual host configurations; if a website’s frontend deploys a CDN or reverse proxy, it is also necessary to verify whether the Apache origin server can be directly accessed via HTTP/2. Apache released HTTP Server 2.4.71 on November 11, 2026, and websites using Apache are advised to upgrade immediately. If upgrading is not immediately possible, HTTP/2 may be temporarily disabled. The issue lies in the assign_headers() function within mod_http2. HTTP/2 permits concurrent processing of multiple requests over a single connection; the affected code contains a synchronization flaw when handling shared resources, potentially leading to heap memory corruption. This vulnerability was discovered by the Anthropic OSS Scanner open-source project scanning initiative and the Google Cloud Vulnerability Research Team. Anthropic reported the issue to the Apache Foundation on October 26, and the Google Cloud team reported the same vulnerability on November 3.