The Apache foundation released version 2.4.71 of its web server on November 11, 2026 to fix CVE-2026-119618, a flaw rated critical in the HTTP/2 module that can lead to remote code execution. All versions from 2.4.55 to 2.4.70 are affected as soon as HTTP/2 is enabled. No exploitation in the wild had been reported by Wiz as of November 11, but the gap between the published assessments argues against waiting.
Poorly synchronized concurrency at the heart of mod_http2
The defect lies in the assign_headers() function of the mod_http2 module, which handles the HTTP/2 protocol in Apache HTTP Server. According to the 2.4 branch vulnerabilities page maintained by the project, it is a problem of concurrent access to a shared resource without proper synchronization, which can result in remote code execution. In practical terms, two operations that touch the same memory area at the same time can corrupt it.
According to Wiz’s analysis, a remote, unauthenticated attacker could thus corrupt the heap and, potentially, run their own commands with the privileges of the web server process. TheHackerWire adds a caveat: uncontrolled corruption mostly crashes a process, which causes a denial of service; going as far as code execution requires knowing how to arrange memory in order to overwrite sensitive pointers, which implies a seasoned attacker.
Servers that only speak HTTP/1.1 are not exposed, notes Rescana, citing Red Hat’s assessment. The mod_h2 module distributed separately on GitHub is also affected, from version 2.0.8 to 2.0.42.
A flaw found by two teams, including an AI scanner
The Apache project credits two independent discoveries. The first came from Anthropic’s OSS Scanner tool, reported on October 26; the second from Anthony Weems and Simon Scannell, of Google Cloud’s vulnerability research team, submitted on November 3. The fix and the disclosure both came on the same day, November 11.
This detail matters: the use of automated analysis tools, including AI-based ones, to comb through major open-source software is speeding up the pace of patches. LinuxCompatible notes that version 2.4.70 was only five days old, and that versions 2.4.68 and 2.4.69 had fixed 13 and 20 flaws respectively this year. The HTTP/2 module and the proxy modules are, according to the same site, the ones that received the most fixes in 2026.
Version 2.4.71 also fixes two less serious defects: CVE-2026-106023, a null pointer dereference in mod_md, the module that manages TLS certificates, rated important and present since 2.4.30; and CVE-2026-109163, a one-byte overflow in mod_vhost_alias, of low severity.
Assessments that diverge on the real risk
The Apache project rates the flaw as critical without giving a numerical score. Rescana reports that Red Hat assigns it 9.8 out of 10, while rating its own Enterprise Linux 9 and 10 systems as “important”, because their per-stream memory management reportedly makes exploitation more difficult.
On whether attack code exists, the sources disagree. Wiz stated on November 11 that no exploit was available. Rescana, citing SecurityWeek, reports that a public proof of concept reproduces memory corruption and crashes without demonstrating code execution, while Red Hat refers to public research that achieved reliable exploitation on a default configuration. As of November 13, the flaw was not listed in the known exploited vulnerabilities catalog of the US agency CISA.
Exposure, for its part, is broad. Wiz estimates that 64% of the cloud environments it observes contain vulnerable resources and that 51% have instances exposed to the Internet, figures that do not take configuration into account.
What administrators should do
- Update to Apache 2.4.71, or to your distribution’s patched package. Debian, Ubuntu and Red Hat released fixes on November 11 and 12, according to Rescana.
- Check exposure: a server is affected if it runs a version in the vulnerable range and loads the http2 module. TheHackerWire suggests checking the version and the list of loaded modules with the apache2ctl or httpd commands.
- If an immediate patch is not possible, restrict the Protocols directive to http/1.1 by removing h2 and h2c, then restart, as recommended by Wiz and Red Hat. This is not a solution validated by Apache, but a stopgap measure.
- Ask your providers: hosting companies and vendors that embed Apache should state their update schedule.
Beware of version numbers: distributions often backport fixes, so a package showing an older number may be patched. The distribution vendor’s security advisory is the authoritative reference.
Frequently asked questions
Is my site vulnerable if it does not use HTTP/2?
No, according to the assessment cited by Rescana: only servers with HTTP/2 enabled are affected. You should nevertheless check the actual configuration, using the module-checking commands mentioned above.
Is the flaw being exploited by hackers?
Wiz had noted no exploitation in the wild as of November 11, 2026, and the flaw was not in the CISA catalog on November 13. A proof of concept causing crashes is circulating, and whether reliable exploitation exists is disputed among the sources.
Which version fixes the standalone mod_h2 module?
The sources differ: Apache’s official page does not name any fixed version, TheHackerWire cites 2.0.43, and Rescana found on November 13 that the latest version published on GitHub was still 2.0.42. The safest course is to check the project’s repository before deploying.
Sources
- Apache HTTP Server 2.4 vulnerabilities — Apache Software Foundation, 2026-11-11
- Apache HTTP Server 2.4.71 releases critical HTTP/2 RCE fix — LinuxCompatible, 2026-11-11
- Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know — Wiz, 2026-11-11
- Critical alert: CVE-2026-119618 exposes Apache HTTP/2 servers to remote code execution — TheHackerWire, 2026-11-11
- Apache httpd mod_http2 CVE-2026-119618: patch now — Rescana, 2026-11-13