Apache Patches critical unauthenticated remote code execution in mod_http2 versions 2.4.55 to 2.4.70

Apache disclosed CVE-2026-119618, a critical flaw in the Apache HTTP Server mod_http2 module that lets attackers without authentication run code remotely on affected servers. The issue affects versions 2.4.55 through 2.4.70, and version 2.4.71 contains the patch. Exploitation requires HTTP/2 to be turned on through the Protocols directive with h2 or h2c settings. Apache ships with http/1.1 by default, so systems using only that setting are not exposed even when running an affected release.

Red Hat rates the flaw at 9.8 on the CVSS scale. An attacker who can reach the server needs no authentication and could take full control of the server process. Red Hat released fixes for Red Hat Enterprise Linux 9 and 10 on November 11, 2026. The vendor rated the issue Important instead of Critical, saying per-stream memory allocation makes an attack much harder. Versions of Red Hat Enterprise Linux 8 and earlier do not contain the vulnerable code.

Red Hat Enterprise Linux 9 receives the fix as mod_http2-2.0.26-7.el9_9.1. The advisories are RHSA-2026:98981 for RHEL 9 and RHSA-2026:98978 for RHEL 10. Debian’s security tracker lists sid as fixed at 2.4.71-1, but bookworm, trixie and forky were still vulnerable on November 12, 2026 at 18:00 JST. When checked, Ubuntu’s CVE tracker had no page for the flaw.

On October 26, Anthropic‘s OSS Scanner reported the issue. Google Cloud Vulnerability Research researchers Anthony Weems and Simon Scannell reported it to Apache on November 3, 2026. The Apache Software Foundation credits both for finding the issue. The problem is a race condition in assign_headers(), where concurrent threads fail to synchronize shared resources properly, causing heap corruption that can lead to remote code execution. Apache’s advisory describes the defect as a concurrency problem in header-handling code that can corrupt memory.

Wiz said that no exploit was available and that no exploitation in the wild had been reported. Apache’s advisory lists no observed attacks. CISA’s KEV catalog did not include CVE-2026-119618 as of November 12, 2026. Red Hat’s assessment states that “public research has demonstrated a reliable exploit” against a server using the default configuration with mod_http2 enabled, though it does not name or link that research.

Wiz data indicates that 64% of cloud environments have resources vulnerable to CVE-2026-119618 and that 51% have publicly exposed instances, not accounting for configuration. Successful remote code execution lets an attacker run arbitrary commands with the privileges of the web server process. A compromised Apache instance running containerized or virtualized workloads in cloud environments can serve as a starting point for lateral movement, potentially exposing nearby microservices or cloud metadata endpoints.

The 2.4.71 release also addresses a mod_md crash rated important. It also addresses a mod_vhost_alias one-byte stack memory overwrite rated low. Those flaws are CVE-2026-106023, covering 2.4.30 through 2.4.70, and CVE-2026-109163, covering 2.4.69 and 2.4.70.

An earlier HTTP/2 issue, CVE-2026-23918, received a patch in version 2.4.67, released on May 4. Systems running 2.4.67 or any later release up through 2.4.70 are still exposed to the new flaw. Apache HTTP Server version 2.4.55 came out in January 2023.

Standalone mod_h2 builds from 2.0.8 through 2.0.42 on GitHub are affected, and no fixed release exists. The repository became read-only when it was archived on June 9. Red Hat says versions of mod_http2 earlier than 2.0.8 do not contain the problematic code.

Administrators should identify the deployed version and confirm HTTP/2 status across server-wide and virtual-host settings. They should get the update from their operating-system vendor, test and deploy it promptly, and restart Apache.

Debian and Ubuntu administrators can check the running version using apache2 -v. Red Hat Enterprise Linux administrators can use httpd -v. To see whether the http2 module is loaded, run apache2ctl -M | grep http2 on Debian or Ubuntu, or httpd -M | grep http2 on Red Hat Enterprise Linux. Having the module present does not mean HTTP/2 is active; the Protocols directive must include h2 or h2c.

Apache’s advisory offers no workaround. Wiz says administrators who cannot patch yet should remove h2 and h2c from the Protocols directive and switch to http/1.1. “Wiz customers can use the pre-built query and advisory in the Wiz Threat Center to search for vulnerable instances in their environment.” Vendors sometimes backport fixes while leaving the upstream version number unchanged, so administrators should check the package advisory instead of trusting the version string alone.

People visiting or using affected websites do not need to do anything about this flaw. People using rental or shared hosting should check their provider’s maintenance or security notices because the hosting company typically handles Apache updates.

If the application runs through a reverse proxy or managed hosting platform, a website owner may not directly control the Apache package. The provider must confirm its patch timetable and any temporary protections. The Apache binary underneath it does not always update when only a website’s application or plugins are updated.

When compromise is suspected, administrators should preserve access and error logs before restarting Apache or changing configuration. A restart can erase memory traces. Administrators should not claim a server is compromised based only on the presence of a vulnerable version. TechBooky says “The advisory does not say that every Apache installation is vulnerable, or that attacks exploiting this flaw have been observed.”

Red Hat points customers with extended support and other products to the CVE page product table for the corresponding advisories. JVN, Japan’s vulnerability information site, published information about CVE-2026-119618 on November 12, 2026. Version 2.4.71 is available from Apache, Red Hat advisories RHSA-2026:98981 and RHSA-2026:98978 are live for RHEL 9 and 10, and Debian sid is fixed at 2.4.71-1.