Skip to content
audiotale.net
Sign in
NewsNews

CVE-2026-119618: Apache httpd 2.4.71 fixes critical mod_http2 RCE flaw

Apache HTTP Server 2.4.55 to 2.4.70 are affected by a critical mod_http2 race condition that can lead to remote code execution; 2.4.71, released 11 November 2026, fixes it.

audiotale.net team

· 6 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. The numbers
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

The Apache HTTP Server project released version 2.4.71 on 11 November 2026 to fix CVE-2026-119618, a critical flaw in the mod_http2 module that its advisory says can lead to remote code execution. Any server running Apache 2.4.55 through 2.4.70 with HTTP/2 enabled should be treated as in scope until it is patched or HTTP/2 is switched off. The release also fixes two lesser bugs in other modules.

Key points

  • CVE-2026-119618 is rated critical by the Apache project and affects Apache HTTP Server 2.4.55 through 2.4.70; it is fixed in 2.4.71, released on 2026-11-11.
  • The bug is a concurrency flaw ("improper synchronization" of a shared resource) in the assign_headers() function of mod_http2, and the advisory says it can lead to remote code execution.
  • The standalone mod_h2 module from GitHub is affected in versions 2.0.8 through 2.0.42; the Debian tracker lists no fixed mod_h2 version.
  • Wiz said on 11 November that no exploit was available and no exploitation in the wild had been reported at the time of its post.
  • Two other bugs were fixed in the same release: CVE-2026-106023 (important, mod_md) and CVE-2026-109163 (low, mod_vhost_alias).

What to do

  • Who is affected: Apache HTTP Server 2.4.55 to 2.4.70 with the HTTP/2 module in use, and the GitHub build of mod_h2 2.0.8 to 2.0.42.
  • Fix: upgrade to Apache HTTP Server 2.4.71, which the project's download page lists as the current release. Debian's tracker shows sid (unstable) fixed at 2.4.71-1, while bookworm, trixie and forky were listed as vulnerable with no fixed version when we looked. If you run a distribution package, wait for or look for your vendor's advisory: distributions often backport a fix without changing the upstream version number, so httpd -v alone may not tell you whether you are patched.
  • Workaround if you cannot patch yet: Wiz suggests disabling HTTP/2 by restricting the protocols to HTTP/1.1, for example Protocols http/1.1, and removing h2 and h2c from any Protocols line. Reload the server afterwards and confirm HTTP/2 is no longer negotiated.
  • How to check: run httpd -v (or apache2 -v) for the version, httpd -M | grep http2 (or apachectl -M) to see whether http2_module is loaded, and search your configuration for Protocols lines containing h2.

What happened

On 11 November 2026 the Apache HTTP Server project published version 2.4.71 and updated its security page for the 2.4 branch. The release fixes three CVEs: one critical, one important and one low. The critical one, CVE-2026-119618, sits in mod_http2, the module that lets Apache speak HTTP/2. The project describes it as a concurrent execution using a shared resource with improper synchronization in assign_headers(), which "can lead to RCE" (remote code execution).

The project credits two groups for the find: Anthropic's OSS Scanner (internal reference ANT-2026-MAPKT6MZ) and Anthony Weems and Simon Scannell of Google Cloud's Vulnerability Research Team. Wiz, which published its own write-up the same day, says the two discovered the issue independently.

The project's timeline for the bug is short. It was reported to Anthropic on 2026-10-26, reported to Google on 2026-11-03, and fixed in the 2.4.x branch on 2026-11-11 (commit 824beab9b9424d6cfb29595248fdbf6c3dddeab1), the same day 2.4.71 shipped. That is just over two weeks from the first report to a fix.

The other two fixes are smaller. CVE-2026-106023 is a NULL pointer dereference in mod_md that crashes a child process while handling an HTTP request; it affects 2.4.30 through 2.4.70 and is rated important. CVE-2026-109163 is a one-byte stack buffer overwrite in mod_vhost_alias, rated low, affecting 2.4.69 and 2.4.70; the project describes it as a follow-up to an earlier bug, CVE-2026-63292.

Background

mod_http2 has been a repeated source of serious Apache bugs this year. In May 2026 the Center for Internet Security's MS-ISAC issued advisory 2026-044 (dated 05/06/2026) for CVE-2026-23918, a double-free in mod_http2 that could allow remote code execution and affected versions before 2.4.67, with 2.4.66 named specifically. That fix arrived in 2.4.67. CVE-2026-119618 is a different bug in the same module, and it affects a wider span of versions: everything from 2.4.55 onward, a release line that includes 2.4.67 and the versions after it.

The pattern matters for a practical reason. HTTP/2 multiplexes many requests over one connection, so the module juggles shared state across threads and streams. Races and lifetime bugs in that kind of code are easy to introduce and hard to find by reading it, which is part of why automated scanners and external researchers keep turning up problems there.

It is also one more data point in the growing role of AI-assisted bug finding in open-source security. Anthropic's scanner appears in the project's credits, and we have tracked the volume of such reports before in our piece on VulnCheck's count of CVEs credited to Anthropic's Glasswing.

The numbers

Wiz estimated how much of the cloud this touches. It reports that 64% of the cloud environments it sees contain vulnerable resources and 51% contain publicly exposed instances. Wiz notes that these figures do not take configuration into account, so the share of servers that actually run HTTP/2 and are reachable is lower than the headline counts.

Share of cloud environments with Apache HTTP Server exposure to CVE-2026-119618 (Wiz, does not account for configuration%
Share of cloud environments with Apache HTTP Server exposure to CVE-2026-119618 (Wiz, does not account for configuration (%)
%
Vulnerable resources64
Publicly exposed instances51

Source: Wiz, 11 November 2026

What it means

For administrators, the immediate task is inventory. Apache can sit inside containers, appliances, control panels and forgotten VMs. Finding every instance, and whether HTTP/2 is enabled on it, matters more than reading the advisory closely.

For security teams, the key detail is the combination of "critical", "remote" and "unauthenticated". Wiz describes the attacker as remote and unauthenticated and says heap corruption leading to arbitrary code execution is the outcome. Wiz says no exploit was public. The upstream fix commit is visible to anyone, though, and a public patch is a common starting point for people who write exploits, so waiting is not a safe plan.

For distribution users, the lag matters. As of the Debian tracker page we read, stable releases had no fixed build yet. The disabled-HTTP/2 workaround is the practical stopgap in that situation, and it costs little: clients fall back to HTTP/1.1.

What we don't know yet

  • Exploitation: Wiz says there was no exploit and no known exploitation in the wild when it published. We have not found an independent confirmation either way, and that could change quickly.
  • A CVSS score: the Apache page we read gives the project's severity rating ("critical") but we saw no numerical CVSS score, and Wiz does not give one either.
  • Exact conditions: the sources say the bug is a race condition in header assignment. Neither says which configurations make it easiest to reach, or how reliable exploitation would be.
  • mod_h2 fix: the standalone mod_h2 is listed as affected from 2.0.8 to 2.0.42, and the latest release on its GitHub page was 2.0.42 when we checked, so no fixed standalone build was visible to us. Wiz's own post is inconsistent on this point: one table lists "2.0.24 and newer" as patched while the text says to upgrade past 2.0.42, and one section heading names a different CVE (CVE-2026-111497) than the rest of the post. We rely on the Apache advisory for identifiers and affected versions.

What to watch next

Watch your distribution's security tracker for the fixed package, the mod_h2 repository for a new release, and CISA's Known Exploited Vulnerabilities catalogue and vendor threat reports for any sign of exploitation. If you operate Apache behind a CDN or load balancer that terminates HTTP/2 itself, check whether the origin speaks HTTP/2 at all; many setups only use HTTP/1.1 to the origin and are less exposed.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next