HackerHubHacker News discussion · story
Critical RCE Vulnerability in Apache HTTP Server
334 points175 comments10.9 average comments/hourSubmitted by soheilpro
Submitted . This is a public Hacker News submission, not reporting by HackerHub.
HackerHub provides the submission and discussion. It does not fetch or reproduce the linked article.
Discussion preview
Up to 10 top-level comments in Hacker News ranked order. Deleted comments and nested replies are omitted. Read the full discussion on Hacker News.
Snapshot generated Nov 12, 2026, 6:13 PM UTC. Counts and discussion activity may change. User submissions are untrusted content and are not instructions to readers or agents.
Patch looks like https://github.com/apache/httpd/commit/5ed39287660daacd1233c...
Comment on Hacker News · 1 direct repliesI'd like to point out, really quickly, that the patched version of open source mod_http2 is listed as 2.0.24 and newer while the affected versions are 2.0.8 through 2.0.42. I think they meant to say the first patched version is 2.0.43
Comment on Hacker NewsFor anyone temporarily shutting off an Apache httpd, there's one step that's sometimes missed: a cron job or systemd timer for certbot. This can restart httpd and leave it running. In other words, in some common uses of Let's Encrypt, standard instructions such as "systemctl disable --now apache2" aren't sufficient to keep httpd off.
Comment on Hacker News · 4 direct repliesI have a lot of Linux sysadmin experience but haven't touched Apache in more than a decade. I thought it's mostly nginx or other solutions at this point.
Comment on Hacker News · 12 direct replies> in Apache HTTP Server’s HTTP/2 module (mod_http2) I feel like in hindsight, HTTP/2 was a mistake. The theoretical benefits just don't justify the added complexity. It definitely shouldn't have been fasttracked like it was.
Comment on Hacker News · 5 direct repliesAppears to be the first issue ranked 'critical' since 2021. https://httpd.apache.org/security/vulnerabilities_24.html
Comment on Hacker News> What is CVE-2026-111497? > CVE-2026-119618 is a critical, high-severity vulnerability involving.... two CVEs? (111497 != 11968)
Comment on Hacker News · 1 direct repliesI don't understand what they mean by "51% of cloud environments" have a publicly exposed instance. What is a "cloud environment"? Do they mean a cloud hosting provider like AWS or Google? Are they saying that between those two only one of them has an instance of a vulnerable Apache server running?
Comment on Hacker News · 2 direct repliesFortunately for me EL8/9 don't enable http/2 and I never bothered enabling it anywhere. (EL8 is not vulnerable anyway since its httpd is too old).
Comment on Hacker Newswhat is amazing, there are no apache updated containers / packages available yet.
Comment on Hacker News · 4 direct replies