BLACKOUT MAP
كل المقالاتتابع @Blackoutmap_net على X

Security ·

Apache's HTTP/2 flaw: found twice in eight days, fixed in 2.4.71

هذا المقال باللغة الإنجليزية.

مشاركة
Updated 12 November, 18:45 UTC
  • First version.

Apache's web server got a critical fix on 11 November. The bug sits in the part that speaks HTTP/2, and it can let a stranger run their own code on the server without logging in. Two teams found it on their own, eight days apart, one of them a machine.

Status on 12 November 2026, 18:45 UTC

The fix is out: Apache HTTP Server 2.4.71, and a Debian 13 package. Affected: 2.4.55 to 2.4.70, but only with HTTP/2 switched on. After updating, restart Apache.

Attacks: none reported, and it is not on CISA's list of exploited flaws. Whether a working exploit is public is disputed: Red Hat says yes, others say no.

The bug in one minute

HTTP/2 lets one connection carry many requests at once, each in its own stream. Apache's mod_http2 handles those streams on several threads at the same time. In one function, assign_headers(), two threads can end up touching the same piece of memory without waiting for each other. Apache's advisory calls it "improper synchronization".

If an attacker times their requests well, one thread writes into memory that another thread is still using. That corrupts the server's heap, and corrupted memory is the classic way in for running your own code. Nothing about it needs a password or a special page. It only needs the server to accept HTTP/2.

Race conditions like this are hard to hit on purpose. That is why the scores differ: Red Hat gives it 9.8 out of 10 in general, but only "Important" on RHEL 9 and 10, because there each stream gets its own memory pool, which "substantially increases the complexity" of an attack.

Found twice in eight days

Apache credits two finders, and the dates are the most interesting part of the advisory:

  • 26 October Anthropic's OSS Scanner, an automated tool that searches open-source code for bugs, reports it to Apache's security team.
  • 3 November Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research report the same bug.
  • 11 November Apache fixes it (commit 824beab) and releases 2.4.71 the same day. Debian ships a fixed package for Debian 13.

Two unrelated teams landing on the same race in one function within a week is the pattern OpenSSH warned about a week ago, when it rushed out its *sshole fix in a day: bugs are now being rediscovered fast, partly by AI tools, so keeping a known hole secret for long is risky. Here Apache took 16 days from the first report, and the second report came in halfway through.

A note on us: posts on this blog are written with help from Claude, which is made by Anthropic, the company whose scanner is credited above.

Are you affected?

You need both

  • Apache HTTP Server 2.4.55 to 2.4.70, or the separate mod_h2 module from GitHub, 2.0.8 to 2.0.42.
  • HTTP/2 switched on: h2 (HTTPS) or h2c (plain HTTP) in a Protocols line.

You're safe with

  • Apache 2.4.71 or newer, or a distribution package with the fix.
  • HTTP/1.1 only. Apache's own default is Protocols http/1.1.
  • RHEL 8 and older: Red Hat says the code isn't there.
  • nginx, Caddy, LiteSpeed, IIS: different software.

The tricky part is the setting. HTTP/2 is off in a plain Apache install, and also in Debian's: we unpacked the fixed Debian package, and http2 isn't in the list of modules it switches on. But turning it on is one command, a2enmod http2, and Debian's file for it then sets Protocols h2 h2c http/1.1 for every site on the server, plain HTTP included. Many guides for faster websites tell people to do exactly that, and control panels often do it for you. So "default is safe" tells you little about a real server.

How many servers?

Nobody knows, and we won't guess. Apache runs about 20.9% of websites whose server software W3Techs can see, but that says nothing about which of them have HTTP/2 on. The cloud security company Wiz says 64% of the cloud environments it sees have resources with an affected version, and 51% have one reachable from the internet, but adds that this "does not take configuration into account". Those are cloud accounts, not servers, and they include servers with HTTP/2 off.

إعلان احصل على Proton VPN اليوم

Is there an exploit?

The sources disagree. Red Hat writes that "public research has demonstrated a reliable exploit against a default-configured server with the mod_http2 module enabled". Wiz wrote at publication that "no exploit is available and there are no reports of exploitation in the wild", and other trackers found no exploit code. We couldn't find the research Red Hat refers to. What is clear: as of 12 November it is not on CISA's list of flaws known to be used in attacks, and nobody has reported one.

Don't wait for that to change. A fix that is public is also a map for attackers: comparing 2.4.70 with 2.4.71 shows exactly where the race is.

What to do

  1. Find out if you run it. apachectl -v shows the version. apachectl -M | grep http2 shows whether the module is loaded, and grep -ri "^\s*Protocols" /etc/apache2 /etc/httpd shows where h2 or h2c is switched on.
  2. Update and restart. On Debian 13: apt update && apt install --only-upgrade apache2 (fixed: 2.4.71-1~deb13u1), then systemctl restart apache2. On other systems, take your distribution's package when it arrives, or build 2.4.71.
  3. Check the package, not only the number. Distributions often patch older versions without changing the version. On 12 November Debian 12's security archive already had 2.4.71-1~deb12u1, but Debian's tracker still listed Debian 12 as vulnerable, and Ubuntu hadn't published a notice yet. Check your distribution's own page for the CVE.
  4. Can't update today? Switch HTTP/2 off: set Protocols http/1.1 (on Debian: a2dismod http2, and remove any other Protocols lines that list h2), run apachectl configtest, then restart. Your site keeps working, just over HTTP/1.1.
  5. Don't count on a CDN. A service in front of your site only protects you if your server can't be reached directly from the internet.

The other two fixes

2.4.71 also fixes CVE-2026-106023, a crash in mod_md (the module that gets Let's Encrypt certificates), rated important, in 2.4.30 to 2.4.70. It takes down one worker process, not the whole server. And CVE-2026-109163, a one-byte overwrite in mod_vhost_alias in 2.4.69 and 2.4.70, rated low. The same update covers all three.

Why this is on Blackout Map

This is a software flaw, not an outage, and it won't show on our map. But broken memory in a web server has two possible endings: an attacker's code, or a crash, and a crash is an outage for everyone who wanted that site. Our Security watch tracks the flaws that are really being used. Read also Can a software flaw take the internet down?

Sources

شارك هذا المقال

Blackout Map is a live map of internet outages and shutdowns around the world. Open the map · Security watch · RSS · Follow us on X: @Blackoutmap_net

كل المقالات

تابع القراءة

Security · 6 Nov 2026 285How one asterisk opened a door in OpenSSH: the *sshole bug, explainedCVE-2026-123158 lets a 257-character password into accounts that have no password, on Alpine and other musl systems. How three sensible fixes built it, who is really affected, what some reports get wrong, and what to do. Security · 21 Oct 2026 16,243PHP2Shell: what we know about the two critical PHP flaws (now exploited)Two critical flaws in PHP, the language behind about 70% of websites, can let anyone run code on a server with one request. The fix is out and attacks are confirmed: how the attack works, what is confirmed, what to do, and what it could mean for the internet. Explainer · 21 Oct 2026 201Can a software flaw take the internet down?Ten years after the Mirai attack on Dyn: how security flaws turn into outages, the times they did, and what Blackout Map can and cannot see.

المزيد من المدونة

Outage · 10 Nov 2026Internet partial outage in Central African Republic: what we measuredBlackout Map measured an internet partial outage in Central African Republic from 20:45 UTC on 7 November 2026. What the data shows, and how to follow it live. Analysis · 6 Nov 2026Is 72 hours of supplies enough? What 93 nationwide power outages showCanada and the UK tell people to be ready for three days without power. We measured 93 nationwide outages since 2022: nine in ten ended within three days. The eight that didn't were all on islands, and local storm damage can take weeks to repair. Fact check · 5 Nov 2026 904Every "global blackout" date so far, and what really happenedA running list of viral global blackout dates: what was claimed, what was real, and why it can't happen that way. Includes 13 and 17 November 2026, with the live status of the internet. Analysis · 5 Nov 2026Election shutdown watch: where the internet could be cut nextThe next elections to watch for internet shutdowns, starting with Cabo Verde, The Gambia, Guinea-Bissau and South Sudan, with each country's live internet status and what happened at this year's votes. Security · 3 Nov 2026Ivanti Connect Secure: three exploited flaws, and the first fix wasn't enoughAttackers chained three flaws to get root on fully updated Ivanti Connect Secure VPN appliances. All three are now on CISA's list of exploited vulnerabilities. Which versions fix it, what the attackers did, and what to check. Fact check · 31 Oct 2026 5,678Is a global blackout coming on 17 November? What the data saysViral posts warn of a worldwide blackout on 17 November: the power out, the internet down for three months, bank accounts at zero. Where it comes from, why it can't happen that way, what is really planned that day, and the live status of every country. Analysis · 24 Oct 2026 112LaLiga's IP blocks: why half a million websites break in Spain on match daysTo fight pirate football streams, Spain's ISPs block shared IP addresses during LaLiga matches, and hundreds of thousands of unrelated websites go down with them. What OONI found, what we measured, and what you can do before Barcelona – Real Madrid. Security · 21 Oct 2026 922Node.js security release: ten fixes, one that can run codeOn the same day as PHP2Shell, Node.js fixed ten flaws in its 22, 24 and 26 lines, including a Brotli decoder bug that can allow remote code execution and several ways around TLS hostname checks. What is affected and what to do. Retrospective · Iran, February 2026 578Iran's wartime blackout: 88 days cut off from the worldFrom the first strikes on 28 February to 26 May 2026, Iran was almost completely cut off from the internet: 2,093 hours, the longest nationwide shutdown on record. What happened, how it worked and what it cost. Retrospective · West Africa, March 2024 148West Africa lost four undersea cables in one dayA suspected underwater landslide off Côte d'Ivoire broke four cables at once in March 2024. Ghana was in blackout for almost a week, Côte d'Ivoire fell to 1% of normal. Retrospective · Canada, July 2022 146How a maintenance update took down Canada's RogersIn July 2022 one update in Rogers' core network cut mobile, home internet, debit payments and emergency calls for millions of Canadians for most of a day. Retrospective · Tonga, January 2022 130Tonga: the volcano that cut a country offThe 2022 Hunga Tonga eruption shredded the only cable linking Tonga to the world. The country was almost completely offline for five weeks. Retrospective · Worldwide, October 2021 188The six hours Facebook disappeared from the internetIn October 2021 one routine command took Facebook, Instagram and WhatsApp off the internet for billions of people. No attack, no country outage. Retrospective · Myanmar, February 2021 145Myanmar 2021: a coup, and an internet curfewAfter the February 2021 coup, Myanmar's military cut the internet nationwide, then every night, then all mobile data: a shutdown shaped by the hour. Retrospective · Tigray, Ethiopia, November 2020 134Tigray: two years without a connectionFrom November 2020, the war in Ethiopia's Tigray region came with a phone and internet blackout that lasted about two years. Retrospective · Iran, November 2019 136Iran, November 2019: a country offline for a weekDuring the 2019 fuel protests Iran cut itself off from the internet almost completely, while keeping parts of its domestic network running. Retrospective · Jammu and Kashmir, India, August 2019 140Kashmir: 550 days without full internetThe shutdown that began in August 2019 became the longest ever imposed in a democracy. High-speed mobile internet only returned in February 2021. Retrospective · Egypt, January 2011 137Egypt 2011: the night a country switched off its internetIn January 2011, two days into mass protests, Egypt withdrew almost all its routes from the internet within minutes. It stayed dark for five days. Retrospective · Pakistan, February 2008 152The day Pakistan took YouTube offline for the whole worldIn 2008 a national block on YouTube leaked into the internet's routing system and made the site unreachable worldwide for about two hours.