Report
Apache patches critical HTTP/2 code-execution flaw, SecurityWeek reports
SecurityWeek reports Apache HTTP Server 2.4.71 fixes a critical flaw affecting only servers with HTTP/2 enabled.
TLDR
According to SecurityWeek, CVE-2026-119618 affects Apache HTTP Server 2.4.55–2.4.70 and could let unauthenticated attackers execute code when HTTP/2 is enabled. The report recommends upgrading to 2.4.71 or vendor-supplied packages, or temporarily disabling HTTP/2. Apache credited Anthropic and Google researchers with independent discoveries, SecurityWeek reports.
Combined views
—
2 Sources, first seen ago
Comments