According to ChainCatcher, Apache HTTP Server versions 2.4.55 through 2.4.70 contain a critical remote code execution vulnerability in the HTTP/2 module (mod_h2 2.0.8-2.0.42). Attackers can trigger a concurrency synchronization flaw without authentication, causing heap memory corruption and code execution with Apache worker process privileges. Affected servers use HTTP/2 protocol via the Protocols directive, including encrypted (H2) and plaintext (H2C) connections.

Apache released version 2.4.71 on November 11 with a patch. Website administrators are advised to upgrade immediately or temporarily disable HTTP/2 if upgrading is not feasible. Affected servers behind CDN or reverse proxy should verify their Apache origin is not directly accessible via HTTP/2. The vulnerability was discovered by Anthropic's open-source vulnerability scanner and Google Cloud's vulnerability research team.

View Source

Disclaimer: This content is for informational purposes only and does not constitute investment advice or encourage the buying or selling of crypto assets. It is intended to provide information about industry developments and is not directly related to the services offered by Gate TR. Although information obtained from third-party sources has been carefully reviewed, Gate TR assumes no responsibility for any errors or omissions. Crypto assets involve high risks and may experience significant price fluctuations. Before making any investment decisions, you should assess your financial situation and risk tolerance, conduct your own research, and make decisions independently.