NewsThe Hacker News
Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
Linked advisories
- CVE-2026-119618Debian LTS apache2: security update
- CVE-2026-119618Red Hat Security Advisory: mod_http2 security update
- CVE-2026-119618Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.
- CVE-2026-119618Debian apache2: security update
- CVE-2026-119618Apache HTTP Server: Race-Condition
- CVE-2026-119618Apache HTTP Server: Race-Condition
- CVE-2026-119618Apache HTTP Server: Mehrere Schwachstellen
Affected vendors and products
More on Unauthenticated
Other advisories
- Not ratedCVE-2026-92735HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with networ…
- Not ratedCVE-2026-91141A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger massive memory allocations by sending a small TC…
- MediumCVE-2026-127206Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat the anti-…
- HighCVE-2026-125327pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests
- HighCVE-2026-125327pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests
- HighCVE-2026-124015XWEB EVO 5.6.2 through 5.8.8 contains an authentication bypass vulnerability that allows unauthenticated attackers to set the password of any account flagged…
- CriticalCVE-2026-124014XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration f…
- MediumCVE-2026-124011XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address a…
Other news entries
- Apache HTTP Server patches critical HTTP/2 remote code execution flawNewsBleepingComputer
- Cisco BroadWorks Out-of-Band Blind XML External Entity Injection VulnerabilityNewsCisco PSIRT
- Apache Patches Critical HTTP Server RCE Found by Anthropic, GoogleNewsSecurityWeek
- Hackers Target N-central Zero-Days as N-able Rushes PatchesNewsSecurityWeek
- Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on FailoverNewsThe Hacker News
- Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' DataNewsThe Hacker News
- Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege EscalationNewsThe Hacker News
- N-able N-central gets emergency fix two days after 33 exploits publishedNewsCSO Online
Source: https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html
ID