Critical RCE Vulnerability in Apache HTTP Server

Re:Critical RCE Vulnerability in Apache HTTP Server by account42 on Thursday November 12, 2026 @05:25AM (#50465333)

> in Apache HTTP Server’s HTTP/2 module (mod_http2)

I feel like in hindsight, HTTP/2 was a mistake. The theoretical benefits just don't justify the added complexity. It definitely shouldn't have been fasttracked like it was.

[ Parent | on HN ]

Re:Critical RCE Vulnerability in Apache HTTP Server by mogoh on Thursday November 12, 2026 @05:31AM (#50465368)

I don't think it was fast tracked. Was it? I heard the rational to do HTTP 2 and soon later HTTP 3 was to split improvements and ease transition.

[ Parent | on HN ]

Re:Critical RCE Vulnerability in Apache HTTP Server by mono442 on Thursday November 12, 2026 @05:34AM (#50465378)

HTTP/3 was the real mistake. It basically reimplements TCP on top of UDP and from my testing (at least the existing implementations) it generally performs worser then HTTP/2. Even when testing on somewhat a bit lossy connection.

[ Parent | on HN ]

Re:Critical RCE Vulnerability in Apache HTTP Server by Woodi on Thursday November 12, 2026 @06:12AM (#50465616)

But if you have more then one httpd server - eg. some fcgi - then HTTP/1.1 is almost architectural backdor: HTTP Request Smuggling, at minimum.

Apache even don't have it's own HTTP/2: mod_http2 use external library nghttp2[.org] so Apache is dead shell at this point.

[ Parent | on HN ]