Apache HTTP ServerにRCE脆弱性、2.4.71で修正
Summary
Apache HTTP Serverのmod_http2に、リモートからコード実行を許しうる脆弱性があり、2.4.55から2.4.70が対象です。2.4.71への更新を、mod_http2を使う公開サーバーから優先して進めてください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Apache HTTP Serverのmod_http2に、リモートからコード実行を許しうる脆弱性があり、2.4.55から2.4.70が対象です。2.4.71への更新を、mod_http2を使う公開サーバーから優先して進めてください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Apache Software FoundationApache HTTP Server |
2.4.55 – 2.4.70→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Fix status by distribution
Records published by each distribution for this CVE. Fixed versions differ by release; check each link.
- Debian DEBIAN-CVE-2026-119618 apache2 No fixed version in this record
Original description The description as published by the source.
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.
This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.
Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
Source: Security Online NVD GitHub Advisory
References
- REDHAT Red Hat
- SECURITYONLINE CVE-2026-119618: Apache HTTP Server Remote Code Execution Fixed in 2.4.71
- web httpd.apache.org
- web nvd.nist.gov
- web github.com
- web openwall.com