Apache HTTP Server flaw could let unauthenticated attackers execute code

Image: Primary

Published Wednesday, November 11, 2026 · 11:06 PM EST

A vulnerability in Apache HTTP Server's HTTP/2 module could allow remote attackers to execute code without authentication, Wiz reported. The flaw, CVE-2026-119618, affects Apache HTTP Server versions 2.4.55 through 2.4.70; version 2.4.71 fixes it. The vulnerability arises when concurrent threads improperly share resources in the assign_headers() function, potentially corrupting heap memory. Successful exploitation would let an attacker run commands with the web server process's privileges. Wiz advises upgrading affected installations or temporarily disabling HTTP/2 support. At publication, it reported no available exploit and no reports of exploitation in the wild.

Sources

wiz.io

Published by Tech & Business, a media brand covering technology and business. This story was sourced from wiz.io and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

Capital AI

Nebuly raises $21m to expand AI return measurement business

Turin-based Nebuly has raised $21m in a Series A round led by Planven to expand its business measuring financial returns from enterprise AI.

AI Science

MIT technique improves climate AI predictions with less training data

MIT researchers developed a training method that helped AI climate models predict unfamiliar emissions scenarios using less data, MIT News reported.

Security Infrastructure

AWS adds individual workload security rules to EKS Auto Mode

AWS says EKS Auto Mode now lets customers apply separate network security rules to individual Pods, the units that run application workloads in Kubernetes. Applications sharing a computing node can use different security groups without requiring separate node pools.

Infrastructure Security

AWS adds centralized traffic logs to Cloud WAN

AWS has made Flow Logs available for Cloud WAN across all Regions where the network service operates, giving core network owners a consolidated view of traffic between VPCs, Regions and connected on-premises networks.

Infrastructure Security

Nvidia adds AI workload inventory to cluster deployment recipes

Nvidia says its open-source AI Cluster Runtime now includes a qualified component for inventorying AI workloads on Kubernetes. Two standard deployment recipes select Google's k8s-aibom by default, while other Google Kubernetes Engine recipes can opt in.

Infrastructure

Amprius receives $75 million contract to retrofit U.S. battery production line

Amprius received a $75 million U.S. government contract to retrofit a domestic battery production line, Yahoo Finance reported. A new manufacturing partner in Indianapolis is targeting pouch-cell production in early 2027.