Apache RCE, Git fixes, and related advisories

Apache HTTP Server disclosed three flaws, including a critical remote code execution bug in mod_http2, while Git shipped maintenance releases covering six vulnerabilities. Glibc, Node.js, xfs_admin, and VVdeC also published security notices.

Apache mod_http2 heap corruption allows remote code execution

oss-security carried CVE-2026-119618, a heap corruption bug in Apache HTTP Server mod_http2, in assign_headers. Versions 2.4.55 through 2.4.70 are affected. The flaw is critical because it can lead to remote code execution.

Git maintenance releases fix six vulnerabilities

Git published v2.56.1 and older maintenance releases that fix six vulnerabilities. One of them is remote code execution through crafted recursive clones, and the affected range reaches back to 2.27. Long-lived Git installations need the corresponding maintenance update, not only the newest line.

Glibc advisory covers a one-byte overflow in wide scanf

The GNU C Library published a security advisory update for 2026-11-11. GLIBC-SA-2026-0027 describes a one-byte overflow in wide scanf conversions for %s and %[. Programs that feed untrusted input to those wide-character scans are the ones that need the fix.

Apache mod_md NULL dereference crashes child processes

CVE-2026-106023 is an important NULL pointer dereference in Apache HTTP Server mod_md. It can crash a child process on versions 2.4.30 through 2.4.69. The impact is availability rather than code execution, but sites that use the module for certificate management are exposed.

Node.js posts high-severity fixes on three lines

A Node.js security release notice on oss-security covers the 22, 24, and 26 lines. The updates fix high-severity issues. Deployments on those lines should take the corresponding security releases.

Red Hat reports command injection in xfs_admin

Red Hat disclosed CVE-2026-108472, OS command injection in xfs_admin, scored CVSS 7.8. A patch has been posted. The bug matters because a filesystem administration helper can be turned into command execution.

Apache mod_vhost_alias one-byte stack overwrite

CVE-2026-109163 is a low-severity one-byte stack buffer overwrite in Apache HTTP Server mod_vhost_alias, published as a follow-up to CVE-2026-63292. The overflow is small, but it is another memory-safety defect in virtual-host handling that should be patched with the rest of the Apache set.

VVdeC heap out-of-bounds read in collocated picture handling

CVE-2026-124312 is a heap out-of-bounds read in VVdeC and vvdecapp, in CodingStructure::getColInfo when the collocated picture is smaller. It affects the 3.x line, and a fix commit was included with the disclosure. Decoders that process untrusted bitstreams should take the update.