High WID-SEC-2026-4517 3 CVEs

Apache HTTP Server: Mehrere Schwachstellen

Published Nov 11, 2026 · Updated Nov 12, 2026 · Revision 2 · de

Vendor: amazon Vendor: Apache Vendor: Debian Vendor: Ubuntu Product: HTTP Server Product: Linux Product: Linux Product: Linux 2 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um einen Denial of Service Angriff durchzuführen oder beliebigen Programmcode auszuführen.

Product

Apache ist ein Webserver für verschiedene Plattformen.

Vulnerabilities 3

High 8.1

CVE-2026-119618 Public exploit

Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from G…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine Wolfi

Nov 11, 2026
Unscored —

CVE-2026-106023

Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash

NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Nov 11, 2026
Unscored —

CVE-2026-109163

Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)

Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Nov 11, 2026

Revision history

2026-11-12 #2
Neue Updates von Amazon, Debian und Ubuntu aufgenommen
2026-11-11 #1
Initiale Fassung

References

Apache HTTP Server 2.4.71 Release vom 2026-11-11
https://httpd.apache.org/security/vulnerabilities_24.html
Proof-of-Concept CVE-2026-119618 vom 2026-11-11
https://github.com/googlesky/CVE-2026-119618
Debian Security Advisory DSA-6620 vom 2026-11-12
https://lists.debian.org/debian-security-announce/2026/msg00540.html
Amazon Linux Security Advisory ALAS2-2026-4114 vom 2026-11-12
https://alas.aws.amazon.com/AL2/ALAS2-2026-4114.html
Debian Security Advisory DLA-4902 vom 2026-11-12
https://lists.debian.org/debian-lts-announce/2026/11/msg00024.html
Ubuntu Security Notice USN-9090-1 vom 2026-11-12
https://ubuntu.com/security/notices/USN-9090-1