Apache posts three HTTP Server flaws, one critical
First merged summary.
Apache disclosed three HTTP Server bugs on November 11, including a critical mod_http2 issue that can lead to remote code execution; no fixes are stated.
On November 11, Eric Covener posted three Apache HTTP Server advisories to oss-security. CVE-2026-119618, rated critical, is an assign_headers synchronization flaw in mod_http2 that can corrupt the heap and lead to remote code execution; it affects server releases 2.4.55 through 2.4.70 and GitHub mod_h2 2.0.8 through 2.0.42. CVE-2026-106023, rated important, is a mod_md NULL pointer dereference that can crash a child process during HTTP request processing. CVE-2026-109163, rated low, is a one-byte stack overwrite in mod_vhost_alias following CVE-2026-63292. None of the posts states a fixed release or exploitation. oss-security subject lines and bodies disagree on whether 2.4.70 is affected by the mod_md and mod_vhost_alias issues.
- CVE-2026-119618 is critical; heap corruption can lead to remote code execution.
- Affected for that bug: httpd 2.4.55–2.4.70 and mod_h2 2.0.8–2.0.42.
- CVE-2026-106023 is an important mod_md NULL dereference that can crash a child.
- CVE-2026-109163 is a low one-byte stack overwrite in mod_vhost_alias.
- No fixed release or exploitation status is stated for any of the three.
- Subject lines name 2.4.70; two advisory bodies describe a narrower range.
Timeline
dated events in the reporting · oldest first- Nov 11, 2026mod_md NULL dereference CVE-2026-106023 posted · oss-security
- Nov 11, 2026mod_vhost_alias one-byte overwrite CVE-2026-109163 posted · oss-security
- Nov 11, 2026Critical mod_http2 heap flaw CVE-2026-119618 posted · oss-security
What each outlet adds
beyond the shared facts- oss-securityThree same-day advisories with severities, version ranges, and subject-versus-body mismatches.
- Vendors
- Apache Software Foundation
- Organizations
- 360 Vulnerability Research Institute
Coverage
oldest first · one row per article · UTC- · 4h ago
oss-securityFirst report
Apache mod_md NULL dereference can crash a child process
Apache rates CVE-2026-106023 important; the body limits it to 2.4.30 through 2.4.69.
- · 4h ago
Apache mod_vhost_alias one-byte stack overflow (CVE-2026-109163)
Apache rates the overflow low; the body names 2.4.69 while the title also lists 2.4.70.
- · 4h ago
Apache HTTP Server mod_http2 heap bug can yield RCE (CVE-2026-119618)
The advisory rates the assign_headers race critical and also covers mod_h2 2.0.8 through 2.0.42.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-106023+1 related CVE | NULL pointer dereference in Apache HTTP Server mod_md | — | — | ||
| CVE-2026-109163 | Stack buffer overflow in Apache HTTP Server mod_vhost_alias 2.4.69 | — | — |