Tento report nie je dostupný v tomto jazyku, preto sa zobrazuje v jazyku: angličtina.

[TLP:CLEAR] Apache HTTP Server is fixing critical vulnerability (RCE)

Apache HTTP Server - RCE (CVE-2026-119618)
CVSS 9.8 (Critical)

Unauthenticated remote attacker is able to execute arbitrary code in Apache HTTP Server's mod_http2 (configured to use HTTP/2) due to incorrect concurrent execution using shared resources with improper synchronization [1][2].

The vulnerability is present in product:

  • Apache HTTP; >=2.4.55, <2.4.71;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-119618 at cve.org, NVD
  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization at cwe.mitre.org

The vulnerability was publicly disclosed 11. 11. 2026.

Apache is fixing a critical vulnerability in Apache HTTP Server with version 2.4.71. This version is also fixing two other vulnerabilities rated as important and low [3].

By CESNET, z.s.p.o. Martin Krajči on 12. 11. 2026.

CESNET, z.s.p.o. Logo