Overview
- The Apache HTTP Server project issued version 2.4.71 on Wednesday to fix a race condition in the assign_headers() function of the HTTP/2 module (mod_http2).
- The bug is a lock-free race that can let two threads free the same heap node, cause heap corruption, and give an unauthenticated remote attacker a path to arbitrary code execution when HTTP/2 is enabled.
- Reports diverge on exploit availability: a vendor assessment says public research shows a reliable exploit while security firm Wiz says no exploit is available and no in-the-wild attacks have been observed.
- Administrators should upgrade to Apache 2.4.71 or, if they cannot patch immediately, remove h2 and h2c from the Protocols directive to disable HTTP/2; some Linux vendors such as Red Hat are shipping distribution packages that add mitigations during rollout.
- Cloud exposure is widespread in some datasets, with Wiz reporting 64% of cloud environments have vulnerable resources and 51% have publicly exposed instances, raising risks of lateral movement for compromised servers and the need to rebuild affected container images.