Apache HTTP Server 2.4.71 Fixes Critical mod_http2 RCE Flaw

The Apache HTTP Server project released version 2.4.71 on November 11 to fix CVE-2026-119618, which it rates critical. The flaw is in mod_http2, the module that adds HTTP/2 support. The project describes it as a “concurrent execution using shared resource with improper synchronization” bug in assign_headers() that can lead to remote code execution. In plain terms, two threads handling HTTP/2 requests can touch the same memory at the same time, and an attacker can use that to corrupt the heap. Red Hat scores the flaw 9.8 out of 10: reachable over the network, no login and no user interaction needed. The Apache advisory credits Anthropic’s OSS Scanner and, separately, Anthony Weems and Simon Scannell of Google Cloud’s Vulnerability Research team; it dates the reports October 26 and November 3.

The sources disagree on whether attackers can already use it. Red Hat’s assessment says “public research has demonstrated a reliable exploit” against a default-configured server with mod_http2 enabled, though The Hacker News notes that Red Hat does not name or link that research. Wiz, in a post published the same day, says no exploit was available and no exploitation in the wild had been reported when it wrote. None of the pages we read says the flaw is being exploited. Red Hat also rates the flaw Important rather than Critical on its own Red Hat Enterprise Linux 9 and 10 packages, because they give each HTTP/2 stream a separate memory allocator, which Red Hat says makes exploitation much harder.

How to check if you’re affected

Affected products are Apache HTTP Server releases 2.4.55 through 2.4.70 with HTTP/2 enabled, and standalone mod_h2 builds from GitHub from version 2.0.8 through 2.0.42. Servers that serve only HTTP/1.1 are not affected, per Red Hat. Check two things:

• Is HTTP/2 on? HTTP/2 runs only where the Protocols directive turns it on, using h2 (HTTP/2 over TLS) or h2c (over plain TCP). It can be set server-wide or per virtual host, so check the server-wide setting and every virtual host (The Hacker News, citing the module documentation).
• Which build do you run? The Apache project’s own fix is 2.4.71. Distributions ship their own package builds with different version numbers, so use your vendor’s tracker rather than comparing against 2.4.71 directly. Per Red Hat, RHEL 8 and earlier do not contain the vulnerable code, and fixes exist for RHEL 9 and 10 (The Hacker News lists mod_http2-2.0.26-7.el9_9.1 for RHEL 9 and mod_http2-2.0.29-5.el10_3.1 for RHEL 10, with the Red Hat advisories). Debian’s tracker, when we read it, showed bookworm, trixie and forky as vulnerable and only unstable (2.4.71-1) as fixed. The Hacker News reported Amazon Linux fixes as pending and found no Ubuntu tracker page; these statuses change quickly, so re-check before relying on them.

The Apache advisory offers no workaround. Wiz advises admins who cannot update yet to remove h2 and h2c from the Protocols directive so the server speaks only http/1.1; that turns HTTP/2 off, so weigh it against what depends on it. The same release also fixes a mod_md crash (CVE-2026-106023, important) and a one-byte stack overwrite in mod_vhost_alias (CVE-2026-109163, low).

Sources

• Apache HTTP Server 2.4 vulnerabilities: fixed in 2.4.71 (CVE-2026-119618)
• Red Hat Customer Portal: CVE-2026-119618
• Wiz: Critical RCE Vulnerability in Apache HTTP Server
• Debian Security Tracker: CVE-2026-119618
• The Hacker News: Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely