News for hackers. Stuff that matters.

A comment on Critical RCE Vulnerability in Apache HTTP Server.

Re:Critical RCE Vulnerability in Apache HTTP Server by jerrythegerbil on Thursday November 12, 2026 @12:23AM (#50463365)
This took 7 minutes and $0.02 in deepseek spend through a subscription to reproduce.

Disabling h2 is the mitigation and is effective. The patch itself seems a little odd as a fix to me personally, but eh.

[ Parent | on HN ]
Re:Critical RCE Vulnerability in Apache HTTP Server by NitpickLawyer on Thursday November 12, 2026 @12:39AM (#50463481)
Did it manage to produce a PoC for RCE? Apparently Redhat claimed there's a RCE, while Wiz said they don't have one.
[ Parent | on HN ]
Re:Critical RCE Vulnerability in Apache HTTP Server by EGreg on Thursday November 12, 2026 @02:31AM (#50464123)
http2 race??

What exactly is the issue and does nginx have it

[ Parent | on HN ]