TL;DR
Apache released HTTP Server 2.4.71 on November 11 to fix CVE-2026-119618, a critical flaw in mod_http2 that Apache says can lead to remote code execution. HTTP/2 must be enabled for the affected path; Red Hat says publicly available research has demonstrated a reliable exploit, while reports of in-the-wild attacks remained unconfirmed in the cited sources.
The Apache HTTP Server project released version 2.4.71 on November 11 to fix CVE-2026-119618, a critical flaw in its mod_http2 module that Apache says can lead to remote code execution. Administrators running affected versions should check whether HTTP/2 is enabled and apply the fixed release or their operating system vendor’s patched package.
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Apache lists HTTP Server versions 2.4.55 through 2.4.70 as affected, along with the standalone mod_h2 module from GitHub in versions 2.0.8 through 2.0.42. The vulnerability concerns the assign_headers() function in mod_http2. Apache describes it as a shared resource synchronization flaw that can cause heap corruption and remote code execution.
The exposure depends on configuration as well as version. Red Hat says the issue affects servers with HTTP/2 enabled through the Protocols directive, using either h2 or h2c. It says servers serving only HTTP/1.1 are not affected. Apache documentation gives “Protocols http/1.1” as the default, but administrators should inspect each server’s actual configuration rather than assume it uses the default.
Red Hat assigns the vulnerability a CVSS 3.1 score of 9.8 out of 10. Apache’s fix is version 2.4.71. Red Hat said fixed packages were shipped on November 11, including updates for RHEL 9 and 10. As of November 12, Debian listed bookworm and trixie as vulnerable and said fixed package 2.4.71-1 was available in unstable, or sid. The source report found no published Ubuntu or SUSE advisory at that time.
Why HTTP/2 Servers Need Attention
The vulnerability matters because, according to Red Hat, a remote attacker who can reach an affected web server could exploit the flaw to execute arbitrary commands without authentication. Apache rates it critical, and Red Hat describes the potential impact as remote code execution. These are vendor assessments of the vulnerability; the cited material does not establish that attacks have occurred against live systems.
Wiz reported that 64% of cloud environments in its data had resources vulnerable to the CVE and that 51% had publicly exposed instances. Wiz cautioned that its figures do not account for configuration. They describe its customer environments, not a global count of vulnerable or exploitable servers, and do not establish that every counted resource had HTTP/2 enabled.
For operators, the practical priority is to identify affected software and configuration, then install a vendor-supported fix. Distribution packages may include backported security changes, so administrators should follow the advisory for their specific operating system and verify the installed package status rather than relying only on the upstream version number.
Products Worth Considering
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
Apple MacBook Pro 16.2-inch with M5 Pro, 18-core CPU, 20-core GPU, 48GB Memory, and 1TB SSD (Space Black)
LG UltraGear evo 52-Inch 5K2K 240Hz Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Flaw Was Reported
HTTP/2 allows a browser to send multiple requests over one connection. Apache’s mod_http2 handles those concurrent requests using multiple threads. The flaw lies in the handling of shared memory between threads. Red Hat explains that one thread can modify memory belonging to another, corrupting the server’s internal memory.
Apache credits the report to Anthropic’s OSS Scanner and two researchers from Google Cloud Vulnerability Research. Apache’s advisory says the Anthropic report reached its security team on October 26; the report from the Google Cloud researchers arrived on November 3. The CVE.org record says the identifier was reserved on October 30. Apache released the patch on November 11.
Linux distribution users may not install software directly from Apache. Vendors package and maintain their own builds, and their vulnerability status can differ by release. Red Hat rated the issue Important for RHEL 9 and 10, explaining that separate allocators for HTTP/2 streams increase exploitation complexity in those packages. It listed RHEL 8 and earlier as not affected, while Red Hat JBoss Core Services and Red Hat Hardened Images were still listed as affected in the report’s November 12 check.
““heap corruption and RCE in assign_headers””
— Apache HTTP Server project
Exploit Activity Remains Unconfirmed
The available sources do not resolve whether attackers have exploited CVE-2026-119618 in the wild. Wiz said on November 11 that it knew of no available exploit and no in-the-wild exploitation reports. The CVE was absent from CISA’s Known Exploited Vulnerabilities catalog when checked on November 12, but the catalog version cited had been released before the CVE became public.
Red Hat separately said public research had demonstrated a reliable exploit against a default-configured server with mod_http2 enabled. Its statement did not name the researchers or say whether their work was publicly available. The source report found no public exploit code linked from the cited advisories. NVD had not published its own CVSS score when checked. These points leave the level of active threat and the precise exploit details unresolved.
Check Configuration and Vendor Fixes
Administrators should first identify Apache and mod_h2 versions across their systems, then check whether HTTP/2 is enabled in each relevant configuration. Where a system is affected, install Apache 2.4.71 or the patched package provided by its operating system vendor, following that vendor’s instructions. Teams using managed hosting or packaged applications should check with the provider or product vendor for its status.
Vendor advisories may change as packages are updated and assessments develop. Debian stable users should consult the current bookworm and trixie advisories; the November 12 report listed those branches as vulnerable while sid had received package 2.4.71-1. Administrators using Ubuntu or SUSE should check for current vendor notices, since the cited report had not found published advisories for those distributions at its check time.
Security teams should also watch for updates from Apache, distribution maintainers, CISA and researchers about exploit availability and confirmed attacks. The cited information supports prompt patching of affected, HTTP/2-enabled servers; it does not establish a confirmed incident or provide a complete account of exploitation activity.
Key Questions
Which Apache versions are affected?
Apache lists HTTP Server 2.4.55 through 2.4.70 and standalone GitHub mod_h2 versions 2.0.8 through 2.0.42 as affected. Apache HTTP Server 2.4.71 contains the upstream fix.
Does the flaw affect servers that use only HTTP/1.1?
Red Hat says servers serving only HTTP/1.1 are not affected. Check the actual Protocols configuration to determine whether HTTP/2 is enabled.
Has the vulnerability been exploited?
The cited sources did not confirm exploitation in the wild. Wiz reported no such reports on November 11, while Red Hat said public research had demonstrated a reliable exploit. CISA’s catalog did not list the CVE in the version checked on November 12.
What should administrators do?
Check installed versions and HTTP/2 configuration, then install Apache 2.4.71 or the fixed package issued by the relevant vendor. Confirm package status against the current vendor advisory, since distribution releases may differ.
Source: Thorsten Meyer AI
