alt Hacker NewsCritical RCE Vulnerability in Apache HTTP Server
Comments
I don't understand what they mean by "51% of cloud environments" have a publicly exposed instance. What is a "cloud environment"? Do they mean a cloud hosting provider like AWS or Google? Are they saying that between those two only one of them has an instance of a vulnerable Apache server running?
duplicate of https://news.ycombinator.com/item?id=50453368
I have a lot of Linux sysadmin experience but haven't touched Apache in more than a decade. I thought it's mostly nginx or other solutions at this point.
> What is CVE-2026-111497?
> CVE-2026-119618 is a critical, high-severity vulnerability involving....
two CVEs? (111497 != 11968)
what is amazing, there are no apache updated containers / packages available yet.
This took 7 minutes and $0.02 in deepseek spend through a subscription to reproduce. The prompt was simply directed at a vulnerable version and told to find a h2 race, which is generically the most common culprit these days. Once it found one, I had it attempt the same against a patched version (which failed).
Disabling h2 is the mitigation and is effective. The patch itself seems a little odd as a fix to me personally, but eh.
LiteSpeed and OpenLiteSpeed affected by this?
gno.security/repairer
No CVSS severity level?
HTTP2 is insecure and 1.1 is slow. At this point just find a good H3 implementation and drop the old protocols.
>Due to improper synchronization when executing concurrent threads sharing resources, an attacker can trigger heap corruption.
>As of the time of this blog’s publication, no exploit is available and there are no reports of exploitation in the wild.
Since when does "memory corruption" = "RCE"? Last week I found and reproduced a memory corruption (a use-after-free) in PHP's runtime after running an on-premise agent for just 30 minutes. There's nothing about it on the internet. Should I write a blog post about a scary new vulnerability? :)
Why does it say the “vendor” for this is GitHub (for mod_h2)?
Is that just crappy LLM generated copy that is assuming that GitHub the company is responsible for that module because it’s hosted there?
From 2.4.55 through 2.4.70? Jokes on you, my version is not that new!
This has not been a good month for the LAMP stack…
The C chansaw juggling doesn't get any safer from adding threads. Is the robust original (pre)fork configuration still supported?
Even Apache is being filled with Claude commits, so great.....
all my handwritten sockets servers are fine because I use HTTP/1.1
I have 1 apache acting as a proxy for vhosts and
> a2dismod http2
gives me
> Module http2 already disabled
I don’t want to tempt fate (and hackers ) but I have dodged lots of major vulns this year with my strategy of writing code by hand instead of pip installing everything
only vuln I was exposed to was copy.fail, but that was a defense in depth weakness, and I was vulnerable to the kvm weakness if there was a malicious tenant in my host’s hypervisor, but that’s not fair I’m poor so I don’t have a dedi.
maybe the tcp vuln was the most exposed I’ve been but that was a very short window that got auto upgraded by apt with a high attack complexity
maybe I can write about how I survived 2026 without getting a supply chain vuln and get some work or students on new years? I feel that’ll be a pretty big accolade.
Wiz is such an amazing company. Israeli-based and recently acquired by Google, the significance of their security contributions cannot be overstated.
Another critical bug discovered by AI.
I want the rabidly AI-hating projects to stand their ground and refuse to fix vulnerabilities discovered with AI assistance.
[dead]
Patch looks like https://github.com/apache/httpd/commit/5ed39287660daacd1233c...