Apache fixes critical HTTP Server RCE in mod_http2

Apache shipped HTTP Server 2.4.71 on November 11 to fix CVE-2026-119618, a critical remote code execution flaw in mod_http2, SecurityWeek reported. The vulnerable versions are 2.4.55 through 2.4.70. Apache's advisory describes a race condition in the assign_headers function that can enable code execution. Red Hat gave the bug a 9.8 CVSS score and said it only affects servers with HTTP/2 enabled, not HTTP/1.1-only deployments.

Apache credited Anthropic's OSS Scanner with the October 26 report and Google Cloud researchers Anthony Weems and Simon Scannell with an independent November 3 report. Multiple threads can step on each other's data in shared memory, leading to corruption.

Wiz said in a blog post on November 11 that it had not seen public exploit code or active attacks. Its telemetry showed resources running affected Apache versions in 64% of the cloud environments it tracks, and publicly exposed instances in 51% of those environments. Wiz cautioned that the counts do not reflect server settings, so they may not show how many are exploitable.

Red Hat said researchers have publicly shown a working exploit against a server with mod_http2 enabled, though its advisory does not name the work. A public GitHub proof-of-concept triggers memory corruption and crashes Apache workers, but it does not prove remote code execution.

Administrators should update to Apache HTTP Server 2.4.71 or apply their vendor's package. If patching cannot happen right away, turning off HTTP/2 can temporarily block the attack. Apache's advisory offers no mitigation; the fix is to upgrade to 2.4.71. The standalone mod_h2 module from GitHub is affected from 2.0.8 through 2.0.42, but no patched mod_h2 release was listed as of November 11. Debian's unstable branch carried apache2 2.4.71-1, while bookworm, trixie, and forky were still marked vulnerable.

CVE-2026-119618 was absent from CISA's Known Exploited Vulnerabilities catalog as of November 10. The 2.4.71 release also addresses CVE-2026-106023, a significant issue that can terminate httpd workers, and CVE-2026-109163, a minor stack buffer overflow.