Apache HTTP Server Patches Critical Remote Code Execution Vulnerability in HTTP/2 Module on November 11

According to ChainCatcher, Apache HTTP Server versions 2.4.55 through 2.4.70 contain a critical remote code execution vulnerability in the HTTP/2 module (mod_h2 2.0.8-2.0.42). Attackers can trigger a concurrency synchronization flaw without authentication, causing heap memory corruption and code execution with Apache worker process privileges. Affected servers use HTTP/2 protocol via the Protocols directive, including encrypted (H2) and plaintext (H2C) connections.

Apache released version 2.4.71 on November 11 with a patch. Website administrators are advised to upgrade immediately or temporarily disable HTTP/2 if upgrading is not feasible. Affected servers behind CDN or reverse proxy should verify their Apache origin is not directly accessible via HTTP/2. The vulnerability was discovered by Anthropic's open-source vulnerability scanner and Google Cloud's vulnerability research team.