Apache HTTP/2 race condition flaw CVE-2026-119618 scores CVSS 9.8, patch to 2.4.71
hunarbatra · x · 2026-11-13
A race condition in Apache HTTP Server's modhttp2 (CVE-2026-119618, CVSS 3.1: 9.8 per Red Hat) allows heap corruption and potential remote code execution via unsynchronized shared resource access in assignheaders(). Versions 2.4.55–2.4.70 are affected, as is standalone modh2 2.0.8–2.0.42. Fix: upgrade to 2.4.71 or a vendor backport, prioritize reachable HTTP/2 deployments, or disable HTTP/2 on affected listeners as a stopgap. Apache published the fix on November 11, crediting Anthropic's OSS security scanner among contributors.
More from Safety
- Agents trust other agents by default — one user's skeptical-agent fix for a real security hole — andrey_kurenkov · 2026-11-13
- OpenAI: frontier models hide their thoughts because training optimizes for capability and compute — The Decoder · 2026-11-13
- 199 reports of soundness bugs in proof checkers collected on one page — jedisct1 · 2026-11-13
- Meta's Muse chatbot sexts while roleplaying as real adult performers — 404 Media · 2026-11-13
- Paul Scharre launches CNAS AI Policy Lab: 'This is the moment' for AI policy — paul_scharre · 2026-11-13
- AI policy veteran Paul Scharre on Altman's "singularity" claim: this is crunch time — paul_scharre · 2026-11-13