Apache HTTP Server vulnerability: critical HTTP/2 flaw fixed in 2.4.71

The Apache HTTP Server project released version 2.4.71 on 11 November 2026 to fix a critical flaw in its HTTP/2 module that can lead to remote code execution. The Apache HTTP Server vulnerability, tracked as CVE-2026-119618, affects versions 2.4.55 through 2.4.70, according to the project's security advisory. Site owners running HTTP/2 on an affected version should update now.

There are no reports of attacks in the wild so far. Cloud security firm Wiz said on 11 November 2026 that, at the time it published, no exploit was available and there were no reports of exploitation in the wild. That can change quickly once a fix is public, so the absence of attacks is not a reason to wait.

What is CVE-2026-119618?

The flaw sits in mod_http2, the module that lets Apache serve pages over HTTP/2. Apache's advisory titles it "mod_http2: heap corruption and RCE in assign_headers" and rates it critical.

Apache describes it as a "Concurrent Execution using Shared Resource with Improper Synchronization" problem, better known as a race condition. In plain terms, HTTP/2 lets a browser send many requests at once over one connection, and the server handles them on several threads. Red Hat's summary says a thread-safety flaw lets one thread write into memory that belongs to another, which corrupts the server's memory.

Red Hat states that the flaw allows unauthenticated remote code execution. That means an attacker who can reach the web server would not need a username or password. Wiz adds that code would run with the privileges of the web server process.

Apache's advisory credits two independent finders: Anthropic's OSS Scanner, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research. It was reported to the Apache security team on 26 October 2026 by Anthropic and on 3 November 2026 by Google.

Which versions and configurations are affected?

The affected range is specific, and so is the configuration.

Item	Detail
Affected Apache HTTP Server versions	2.4.55 through 2.4.70
Affected standalone mod_h2 (GitHub)	2.0.8 through 2.0.42
Fixed version	Apache HTTP Server 2.4.71
Required condition	HTTP/2 enabled
Apache severity rating	Critical

Only servers with HTTP/2 switched on are exposed. Red Hat says the issue affects servers with HTTP/2 (h2 or h2c) enabled through the Protocols directive, and that servers serving only HTTP/1.1 are not affected.

This matters because HTTP/2 is not on by default in Apache itself. The Apache core documentation gives the default as "Protocols http/1.1" and says only HTTP/1.1 is allowed unless an administrator adds more protocols. Hosts, control panels and administrators can switch HTTP/2 on, so do not assume you are safe without checking.

How severe is it?

Apache rates the flaw critical but has not published a numeric score. The official CVE record carried a text severity of "critical" with no CVSS score when we checked on 12 November 2026.

Red Hat has assigned its own CVSS v3.1 score of 9.8 out of 10. It rates the flaw Critical overall, but only Important for Red Hat Enterprise Linux 9 and 10. Red Hat says the mod_http2 packages in those releases allocate each HTTP/2 stream from a separate allocator, which substantially increases the complexity of exploiting the flaw. Red Hat Enterprise Linux 8 and earlier are not affected.

Scores from different organisations can differ, so treat 9.8 as Red Hat's assessment, not a final industry figure.

Is the flaw being exploited?

Not as far as anyone has confirmed. Wiz reported no exploitation in the wild as of 11 November 2026, and our own searches on 12 November 2026 did not find a national cyber agency alert reporting attacks.

There is one point of difference between sources. Wiz said no exploit was available. Red Hat's statement says public research has demonstrated a reliable exploit against a default-configured server with the mod_http2 module enabled. Those two statements are not the same thing as attacks on real websites, but they suggest the flaw is practical to exploit, not just theoretical.

Wiz also published exposure figures from its own customer data. It said 64% of cloud environments have resources vulnerable to CVE-2026-119618 and 51% have publicly exposed instances. Wiz noted that this data does not take configuration into account, so the share actually running HTTP/2 will be lower.

How do I check my Apache version?

On a server you manage, the httpd program reports its own version. The Apache documentation lists these options:

• httpd -v prints the version and exits.
• httpd -M lists the loaded modules, which shows whether the HTTP/2 module is present.

On some Linux distributions the command is apache2 or apachectl instead of httpd. Then search your configuration files for a Protocols line that includes h2 or h2c.

Be careful with version numbers on Linux distributions. Vendors often patch older versions in place, so the number alone can mislead. Use your distribution's security tracker, such as the Debian tracker entry, which lists each Debian release as vulnerable or fixed, to confirm whether your installed package is patched.

What should site owners do now?

1. Find out who runs your web server. On shared or managed hosting, the host applies the update. Ask whether they run Apache with HTTP/2 and when the fix was or will be applied.
2. Update to Apache HTTP Server 2.4.71. The release announcement says this release is recommended over all previous releases. If you install Apache from your operating system, apply the vendor's security update.
3. If you cannot patch at once, turn off HTTP/2. Wiz advises restricting the server to HTTP/1.1 by removing h2 and h2c from the Protocols directive until the update is in place. Pages will still load; they just lose HTTP/2's speed benefits for a while.
4. Restart and confirm. Check the version or package again after the update.
5. Do not forget bundled copies. Apache is built into many appliances, containers and software stacks. Those need a vendor update too.

Apache's own advisory does not list a workaround, so the HTTP/2 switch-off is guidance from Wiz and follows from Red Hat's statement that HTTP/1.1-only servers are unaffected.

What else does 2.4.71 fix?

The release closes two other issues. CVE-2026-106023, rated important, is a NULL pointer dereference in mod_md that can crash a child process. CVE-2026-109163, rated low, is a one-byte stack buffer overwrite in mod_vhost_alias that affects versions 2.4.69 and 2.4.70 only.

Our analysis

The following is our view, not a statement from Apache. This is the kind of flaw that deserves a same-week response: no login needed, reachable over the network, and in software that sits directly on the internet. The fact that it was found independently by two teams, one using an automated scanner, also fits a wider pattern of AI tools being used to check security-critical code.

For small site owners, the practical lesson is about patch routines. Keeping server software current remains one of the most common gaps we covered in our guide to cybersecurity challenges and solutions. Knowing who is responsible for your web server, and how fast they patch, is worth settling before the next advisory lands.

Sources

• Apache HTTP Server 2.4 vulnerabilities (Apache HTTP Server Project)
• Apache HTTP Server 2.4.71 release announcement
• CVE-2026-119618 record (CVE Program)
• CVE-2026-119618 (Red Hat Customer Portal)
• CVE-2026-119618: RCE in Apache HTTP Server (Wiz)
• CVE-2026-119618 (Debian Security Tracker)
• Protocols directive, Apache core documentation
• httpd program options (Apache documentation)