NewsThe Hacker News
Kritischer Apache HTTP/2-Fehler ermöglicht Ferncodeausführung
Teaser aus der Quelle
Ein kritischer Fehler in der HTTP/2-Modul von Apache HTTP Server, mod_http2, ermöglicht es einem entfernten Angreifer, Code auf dem Server auszuführen. Unter CVE-2026-119618 bekannt, betrifft es Versionen 2.4.55 bis 2.4.70 und wurde in Version 2.4.71 behoben. Betroffen sind nur Server mit aktiviertem HTTP/2, wie von Red Hat bestätigt. Ein Update auf Version 2.4.71 wird empfohlen.
Dies ist ein Anriss aus dem RSS-Feed. Den vollständigen Artikel lesen Sie beim Original.
Artikel bei The Hacker News lesenVerknüpfte Advisories
- CVE-2026-119618Debian LTS apache2: security update
- CVE-2026-119618Red Hat Security Advisory: mod_http2 security update
- CVE-2026-119618Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.
- CVE-2026-119618Debian apache2: security update
- CVE-2026-119618Apache HTTP Server: Race-Condition
- CVE-2026-119618Apache HTTP Server: Race-Condition
- CVE-2026-119618Apache HTTP Server: Mehrere Schwachstellen
- CVE-2026-119618Apache HTTP Server vulnerabilities
Betroffene Hersteller und Produkte
Mehr zu Unauthenticated
Weitere Advisories
- MittelCVE-2026-92735HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with networ…
- Ohne BewertungCVE-2026-91141A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger massive memory allocations by sending a small TC…
- MittelCVE-2026-127206Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat the anti-…
- HochCVE-2026-125327pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests
- HochCVE-2026-125327pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests
- HochCVE-2026-124015XWEB EVO 5.6.2 through 5.8.8 contains an authentication bypass vulnerability that allows unauthenticated attackers to set the password of any account flagged…
- KritischCVE-2026-124014XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration f…
- MittelCVE-2026-124011XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address a…
Weitere News-Einträge
- Apache HTTP Server patches critical HTTP/2 remote code execution flawNewsBleepingComputer
- Cisco BroadWorks Out-of-Band Blind XML External Entity Injection VulnerabilityNewsCisco PSIRT
- Apache Patches Critical HTTP Server RCE Found by Anthropic, GoogleNewsSecurityWeek
- Hackers Target N-central Zero-Days as N-able Rushes PatchesNewsSecurityWeek
- Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on FailoverNewsThe Hacker News
- Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' DataNewsThe Hacker News
- Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege EscalationNewsThe Hacker News
- N-able N-central gets emergency fix two days after 33 exploits publishedNewsCSO Online
Quelle: https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html
ID