Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-119618: Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. CVE-2026-109163: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | httpd | 0:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | httpd-core | 0:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | httpd-core-debuginfo | 0:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | httpd-debuginfo | 0:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | httpd-debugsource | 0:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | httpd-devel | 0:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | httpd-filesystem | 0:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | httpd-manual | 0:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | httpd-tools | 0:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | httpd-tools-debuginfo | 0:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mod_http2 | 1:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mod_http2-debuginfo | 1:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mod_ldap | 0:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mod_ldap-debuginfo | 0:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mod_lua | 0:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mod_lua-debuginfo | 0:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mod_proxy_html | 1:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mod_proxy_html-debuginfo | 1:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mod_session | 0:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mod_session-debuginfo | 0:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mod_ssl | 1:2.4.71-1.amzn2023.0.1 |
| Amazon Linux · 2023 | mod_ssl-debuginfo | 1:2.4.71-1.amzn2023.0.1 |
Vulnerabilities 2
-
High 8.1CVE-2026-119618 Public exploit
Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from G…
-
Unscored —
Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)
Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69.