Vulnerabilità · 147 giorni fa
Apache’s latest fixes point to a recurring problem: protocol handlers are turning routine parsing mistakes into code execution and denial of service. The standard response is to treat this as a patch-only event, but the bigger issue is that HTTP/2 and AJP are exposed attack surfaces that can fail hard before any application logic is reached.
Apache HTTP Server 2.4.67 fixes 11 flaws, including CVE-2026-23918, an HTTP/2 double-free that can lead to DoS and possible RCE, and CVE-2026-28780, an AJP heap buffer overflow that can let remote attackers trigger DoS and execute code. The release also closes multiple DoS and information disclosure bugs, plus response manipulation and Digest authentication bypass issues. Apache MINA 2.2.7 and 2.1.12 fix two critical flaws, CVE-2026-42778 and CVE-2026-42779, both tied to incomplete prior fixes that can still lead to code execution.
Protocol parsing bugs in widely deployed server components keep producing high-severity failures because they sit in front of everything else. That makes Apache’s handler layer a recurring source of critical exposure, not a one-off defect class.
CVE in questo aggiornamento
9 CVE
Distribuite tra macOS, azl3 httpd 2.4.66-1 on Azure Linux 3.0, DevOps Code ClearCase e altri pacchetti correlati.
0 critiche · 5 alte · 3 medie · 0 basse
0 in CISA KEV · 0 con EPSS sopra 1%
Severità più alta: CVE-2026-23918 · 8.8 HIGH
2 fonti che coprono questa storia
Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE
Apache fixes CVE-2026-23918 in HTTP/2; double-free flaw enables DoS and RCE, impacting version 2.4.66 users.
Critical, High-Severity Vulnerabilities Patched in Apache MINA, HTTP Server
The most severe of these security defects could allow remote attackers to execute arbitrary code.
Part of the PlainSec briefing for 2026-05-05