2 lines
3.2 KiB
JSON
2 lines
3.2 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.70","status":"affected","version":"2.4.55","versionType":"semver"}]}],"source":"security@apache.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","matchCriteriaId":"EA2A33DB-23BB-4A27-9579-7EB1A977580C","versionEndExcluding":"2.4.71","versionStartIncluding":"2.4.55","vulnerable":true},{"criteria":"cpe:2.3:a:icing:mod_http2:*:*:*:*:*:apache_httpd:*:*","matchCriteriaId":"C1F96999-0729-4CBE-80D1-F7AC6A24301E","versionEndExcluding":"2.0.42","versionStartIncluding":"2.0.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42."}],"id":"CVE-2026-119618","lastModified":"2026-11-14T05:18:29.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119618","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T15:17:15.900","references":[{"source":"security@apache.org","tags":["Patch","Vendor Advisory"],"url":"https://httpd.apache.org/security/vulnerabilities_24.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/11/11/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://access.redhat.com/security/cve/cve-2026-119618"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"],"url":"https://bugs.gentoo.org/986161"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking"],"url":"https://github.com/AlmaLinux/updates/issues/4252"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"url":"https://github.com/microsoft/azurelinux/pull/20165"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://ubuntu.com/security/CVE-2026-119618"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Third Party Advisory"],"url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"security@apache.org","type":"Secondary"}]}
|