🔍 Read the full analysis: Critical Apache HTTP/2 Flaw CVE-2026-119618: Key Facts And Actions on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Apache released HTTP Server 2.4.71 on November 11 to fix CVE-2026-119618, a critical flaw in mod_http2 that Apache says can lead to remote code execution. The issue affects versions 2.4.55 through 2.4.70 when HTTP/2 is enabled; vendor package status varies. Public reporting on exploitation is mixed, so administrators should check configurations and install available fixes promptly.
Apache released HTTP Server 2.4.71 on November 11 to fix CVE-2026-119618, a critical flaw in mod_http2 that the project says can lead to remote code execution. The vulnerability affects Apache HTTP Server versions 2.4.55 through 2.4.70 when HTTP/2 is enabled, making configuration checks and prompt patching important for server administrators.
Apache describes the defect as a concurrent execution and synchronization flaw in the mod_http2 function assign_headers, with the advisory title referring to heap corruption and remote code execution. Red Hat explains that one thread may modify memory belonging to another, corrupting the server’s internal memory. Red Hat says a remote attacker able to reach an affected server could execute arbitrary commands without authentication. It assigns the flaw a CVSS 3.1 score of 9.8 out of 10; the National Vulnerability Database had not published its own score as of November 12.
The affected upstream releases are Apache HTTP Server 2.4.55 through 2.4.70 and standalone mod_h2 versions 2.0.8 through 2.0.42. Apache’s fixed release is 2.4.71. Exposure depends on configuration: Red Hat says servers with HTTP/2 enabled through the Protocols directive are affected, while servers serving only HTTP/1.1 are not. Administrators should inspect actual settings rather than assume a server’s protocol configuration.
Vendor status differed on November 12. Red Hat shipped fixed packages on November 11, including updates for RHEL 9 and 10, while saying RHEL 8 and earlier are not affected. Red Hat continued to list JBoss Core Services and Hardened Images as affected. Debian listed bookworm and trixie as vulnerable, with fixed package 2.4.71-1 available only in unstable, or sid. The source report found no published Ubuntu or SUSE advisory at that time; administrators should check those vendors for current status.
Apache HTTP/2 flaw Key facts and actions
Apache released HTTP Server 2.4.71 to fix a critical flaw that can lead to remote code execution. Exposure depends on the affected version and whether HTTP/2 is enabled.
Check whether you are exposed
The flaw is in mod_http2; configuration determines whether an affected server is at risk.
Check Apache HTTP Server versions 2.4.55–2.4.70 and standalone mod_h2 versions 2.0.8–2.0.42.
Confirm whether HTTP/2 is enabled through the Protocols directive. Servers serving only HTTP/1.1 are not affected, according to Red Hat.
Install Apache 2.4.71 or the fixed package provided by your operating-system vendor.
Vendor package status varies
Check the advisory for the distribution running your server; upstream and vendor package status may differ.
| Vendor or release | Status reported November 12 |
|---|---|
| Red Hat | Fixed packages shipped for RHEL 9 and 10; RHEL 8 and earlier listed as not affected. |
| JBoss Core Services and Hardened Images | Red Hat continued to list these as affected. |
| Debian bookworm and trixie | Listed as vulnerable; fixed package 2.4.71-1 available in unstable (sid). |
| Ubuntu and SUSE | No advisory found in the source report at that time; check current vendor notices. |
Exploitation reports conflict
Public statements do not confirm whether attacks are happening in the wild.
- No available exploit and no known in-the-wild attacks when published November 11.
- Its cloud figures did not account for configuration and are not counts of exploitable servers.
- Public research had demonstrated a reliable exploit against a default-configured server with mod_http2 enabled.
- The research was not identified, and its public availability was not stated.
Why the flaw matters
A synchronization flaw in mod_http2’s assign_headers function can corrupt server memory.
Remote code execution
Red Hat says a remote attacker able to reach an affected server could run arbitrary commands without authentication.
Review reachable servers
Inventory versions and protocol settings, then follow normal security monitoring and incident-response procedures.
Why HTTP/2 Servers Need Prompt Review
The flaw matters because the reported consequence is remote code execution without authentication, which could let an attacker who can reach an exposed server run commands there. Apache’s critical rating and Red Hat’s 9.8 score indicate a serious risk, although actual exposure depends on the affected software version and whether HTTP/2 is enabled.
Wiz reported that 64% of cloud environments in its own data had resources it considered vulnerable and 51% had publicly exposed instances. Wiz cautioned that its figures did not account for configuration, so they are not a count of exploitable servers and should not be treated as a measure of the total internet-facing risk. The figures do underline why organizations need to inventory deployed versions and protocol settings.
Patch status can also differ between an upstream project and Linux distributions. A server may rely on packages maintained by its operating-system vendor, so administrators should follow that vendor’s advisory and install the applicable fixed package rather than assume that an upstream release has already reached their system.
Products Worth Considering
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Amazon Kindle Paperwhite (12th Generation, 2024), 16GB, 7-Inch Display, Raspberry
Apple Watch Series 8 GPS 41mm Midnight Aluminum Case with Midnight Sport Band
As an affiliate, we earn on qualifying purchases.
From Initial Report to Apache Patch
Apache credited Anthropic’s OSS Scanner and two researchers from Google Cloud Vulnerability Research with finding the flaw. According to Apache, Anthropic reported it on October 26, followed by the Google Cloud researchers on November 3. The CVE number was reserved on October 30, according to the CVE record.
Apache published the fix in version 2.4.71 on November 11. The project advisory was posted to the oss-security mailing list that day, and Red Hat’s CVE entry and the public CVE record followed. The reported interval from Anthropic’s submission to the release was 16 days. The AI scanner’s role is part of the disclosure history; it does not change the need to verify the finding and apply the vendor’s patch.
HTTP/2 allows multiple requests to be handled over a single connection. Apache’s mod_http2 manages concurrent requests using multiple threads, the area in which the synchronization problem was found. Apache’s documentation lists HTTP/1.1 as the default protocol configuration, but administrators may have enabled HTTP/2 themselves.
““Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server’s mod_http2 in assign_headers() can lead to RCE.””
— Apache HTTP Server project advisory
Exploit Reports Remain Inconsistent
Available statements do not give a clear answer on whether the flaw is being exploited. Wiz reported no available exploit and no known attacks when it published on November 11. Red Hat, however, said public research had demonstrated a reliable exploit against a default-configured server with mod_http2 enabled. Red Hat did not identify the researchers or say whether the research was publicly available.
The CVE was not listed in the CISA Known Exploited Vulnerabilities catalog when checked on November 12, but the cited catalog version predated public disclosure. Its absence at that point does not establish that exploitation has not occurred. The available advisories did not link to public exploit code, and the NVD had not yet published a score. The number of genuinely exposed servers, the extent of any attacks and the identity or availability of the cited exploit research remain unclear.
Check Protocols and Vendor Advisories
Administrators should identify Apache and standalone mod_h2 versions, confirm whether HTTP/2 is enabled, and apply Apache 2.4.71 or the relevant fixed package from their operating-system vendor. Where a vendor had not published an advisory by November 12, teams should monitor its security notices for affected-version guidance and package updates.
Organizations should also review whether affected servers are reachable from outside their networks and follow their normal security monitoring and incident-response procedures. The next useful updates will be vendor advisories for distributions whose status was not yet published, any revised exploitation assessments, and further details from the Apache project or security researchers. The source material provides no later disclosure or attack confirmation.
Key Questions
Which Apache versions are affected?
Apache lists HTTP Server 2.4.55 through 2.4.70 as affected. The standalone mod_h2 release range listed is 2.0.8 through 2.0.42. Apache’s upstream fix is 2.4.71.
Does the flaw affect servers that use only HTTP/1.1?
Red Hat says servers serving only HTTP/1.1 are not affected. Administrators should check their actual Protocols configuration to determine whether HTTP/2 is enabled.
Is CVE-2026-119618 being exploited?
The public accounts conflict. Wiz reported no available exploit or known in-the-wild attacks on November 11, while Red Hat said public research had demonstrated a reliable exploit. The material does not confirm attacks in the wild.
What should administrators do now?
Check the installed Apache or mod_h2 version and whether HTTP/2 is enabled, then install Apache 2.4.71 or the applicable vendor-fixed package. Follow the operating-system vendor’s advisory because package availability varies.
Were AI tools involved in finding the flaw?
Apache credited Anthropic’s OSS Scanner as one finder, alongside two researchers from Google Cloud Vulnerability Research. Apache said the scanner’s report arrived on October 26, before the Google Cloud researchers’ report on November 3.
Source: ThorstenMeyerAI.com
