Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-119618: Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. CVE-2026-109163: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292) CVE-2026-106023: mod_md NULL pointer dereference leads to child process crash
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | httpd | 0:2.4.71-1.amzn2.0.1 |
| Amazon Linux · 2 | httpd-debuginfo | 0:2.4.71-1.amzn2.0.1 |
| Amazon Linux · 2 | httpd-devel | 0:2.4.71-1.amzn2.0.1 |
| Amazon Linux · 2 | httpd-filesystem | 0:2.4.71-1.amzn2.0.1 |
| Amazon Linux · 2 | httpd-manual | 0:2.4.71-1.amzn2.0.1 |
| Amazon Linux · 2 | httpd-tools | 0:2.4.71-1.amzn2.0.1 |
| Amazon Linux · 2 | mod_http2 | 1:2.4.71-1.amzn2.0.1 |
| Amazon Linux · 2 | mod_ldap | 0:2.4.71-1.amzn2.0.1 |
| Amazon Linux · 2 | mod_md | 0:2.4.71-1.amzn2.0.1 |
| Amazon Linux · 2 | mod_proxy_html | 1:2.4.71-1.amzn2.0.1 |
| Amazon Linux · 2 | mod_session | 0:2.4.71-1.amzn2.0.1 |
| Amazon Linux · 2 | mod_ssl | 1:2.4.71-1.amzn2.0.1 |
Vulnerabilities 3
-
Unscored —
Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash
NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.
-
Unscored —
Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)
Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69.
-
Unscored —CVE-2026-119618 Public exploit
Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from G…