- 13th November 2026
CVE-2026-119618 (HTTP2Reset) lets one unauthenticated HTTP/2 request corrupt the heap of Apache HTTP Server 2.4.55 to 2.4.70. Public labs crash workers on demand, and attacker bytes reach a dereferenced pointer. The fix in 2.4.71 is one line, but only servers that actually speak HTTP/2 are reachable.
Daniel Reeves


















