YHK - yet another hacker news clone

Critical RCE Vulnerability in Apache HTTP Server

28 points soheilpro 1 hour ago 17 comments

superkuh 58 minutes ago | parent

It's not always HTTP/2. But it's a pretty safe bet.

userbinator 25 minutes ago | parent

The vulnerability affects deployments utilizing HTTP/2 capabilities

koolba 47 minutes ago | parent

Why does it say the “vendor” for this is GitHub (for mod_h2)?

Is that just crappy LLM generated copy that is assuming that GitHub the company is responsible for that module because it’s hosted there?

stonogo 8 minutes ago | parent

Yes, this is slop, extruded from reading the patch and the official announcement, which is at https://httpd.apache.org/security/vulnerabilities_24.html#CV...

kgeist 43 minutes ago | parent

>Due to improper synchronization when executing concurrent threads sharing resources, an attacker can trigger heap corruption.

>As of the time of this blog’s publication, no exploit is available and there are no reports of exploitation in the wild.

Since when does "memory corruption" = "RCE"? Last week I found and reproduced a memory corruption (a use-after-free) in PHP's runtime after running an on-premise agent for just 30 minutes. There's nothing about it on the internet. Should I write a blog post about a scary new vulnerability? :)

fooqux 35 minutes ago | parent

If you can corrupt memory in a controllable way, you can get a computer to do just about anything that process has rights to. Possibly even the kernel, if you can get at some shared memory.

kgeist 32 minutes ago | parent

But it's not a given that memory corruption is exploitable as an RCE specifically. I thought to call something an RCE you need a working exploit?

edoceo 26 minutes ago | parent

Isn't resource consumption a DoS?

woodruffw 23 minutes ago | parent

A denial of service is a different class of vulnerability (a minor one, generally).

stonogo 7 minutes ago | parent

Presumably one of Anthropic, Google, or Apache possesses a working exploit, because the official Apache Foundation report on this CVE claims RCE is possible.

woodruffw 27 minutes ago | parent

I was prepared to disagree with you, but I agree: I'd say there's a strong norm of not calling things RCE unless you can actually demonstrate RCE, or at least have a clean pathway to demonstrating it (e.g. a full write-what-where).

It's perfectly sufficient to have a CVE for just memory corruption, so the "RCE" framing here feels overstated. Particularly when an LLM should easily prove RCE out if it is in fact present.

thehamkercat 35 minutes ago | parent

> What is CVE-2026-111497?

> CVE-2026-119618 is a critical, high-severity vulnerability involving....

two CVEs? (111497 != 11968)

lakeviewterrace 21 minutes ago | parent

Another critical bug discovered by AI.

I want the rabidly AI-hating projects to stand their ground and refuse to fix vulnerabilities discovered with AI assistance.

nozzlegear 16 minutes ago | parent

> I want the rabidly AI-hating projects to stand their ground and refuse to fix vulnerabilities discovered with AI assistance.

Why?

wild_pointer 15 minutes ago | parent

From 2.4.55 through 2.4.70? Jokes on you, my version is not that new!