A network request may be enough to execute code on certain Apache servers: CVE-2026-119618 affects mod_http2 and requires no authentication, provided HTTP/2 is enabled. Apache released version 2.4.71 on November 11 to fix it. Red Hat assigns the flaw a score of 9.8 out of 10 on CVSS and rates it critical.
The issue does not affect every Apache HTTP Server installation. According to Red Hat, servers using HTTP/2 through mod_http2 are exposed; those configured for HTTP/1.1 only are not vulnerable. The fixed version also resolves two other, less severe vulnerabilities in mod_md and mod_vhost_alias.
A race condition in assign_headers()
The issue originates in assign_headers(), a mod_http2 function. The vulnerability is caused by a race condition: while requests are being processed concurrently, one thread can modify memory belonging to another. RedesZone describes the result as heap corruption; Red Hat explains that a worker can write to a connection thread's memory through a shared allocator without locking.
The flaw, tracked as CVE-2026-119618, could allow a remote attacker to execute arbitrary commands and take control of the server process. Red Hat also lists possible access to or modification of sensitive information and service disruption among the impacts. Its CVSS v3.1 assessment specifies a network attack vector, low complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, and availability.
The vulnerability affects Apache HTTP Server versions from 2.4.55 through 2.4.70. Version 2.4.71, announced by the Apache Software Foundation and the Apache HTTP Server project, is the fix for users of versions distributed by the project itself.
HTTP/2 must be enabled for exposure
The setting that determines exposure is the Protocols directive. In it, h2 enables HTTP/2 over TLS, while h2c enables it over unencrypted TCP. The value can be set for the entire server or for a specific virtual host; therefore, checking only the global configuration is not enough to verify every hosted site.
The module documentation and security advisories state that installations configured to serve HTTP/1.1 only are not affected. However, if h2 or h2c appears in a virtual host's directive, that setting must also be taken into account. The check covers both the general configuration and that of each virtual host.
The scope also includes standalone builds of the module published on GitHub as mod_h2: affected versions range from 2.0.8 to 2.0.42. That repository was archived on June 9 and made read-only; no fixed version is available for that branch. The configuration mitigation specified for Apache also applies to those builds.
Red Hat and Wiz disagree about exploits
The availability of a reliable exploit is where the published assessments differ. Red Hat says that a reliable exploit exists, demonstrated by public research against a server with mod_http2 enabled in its default configuration. Its advisory does not identify that research. Wiz, for its part, said that same day that no exploit was available and that no active exploitation had been reported.
“public research has demonstrated a reliable exploit”
— Red Hat
The flaw was detected on October 26 by Anthropic's OSS Scanner, an open-source code analysis service that uses the company's AI models, according to The Hacker News. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research independently reported it on November 3, according to RedesZone; Red Hat also thanks them for the report in its CVE entry.
The sources do not offer a shared conclusion on whether an exploit is available. Red Hat describes public research demonstrating a reliable one; Wiz denies that one is available and that exploitation in real-world systems is known. The 9.8 score is Red Hat's assessment: the CVE entry notes that scores for open-source components can vary between vendors due to differences in versions or builds.
Patch and distribution packages
Red Hat released fixes for Red Hat Enterprise Linux 9 and 10, but classifies the flaw as Important in those products rather than Critical. The reason it gives is that its mod_http2 packages allocate separate memory for each HTTP/2 stream, making exploitation more difficult. RHEL 8 and earlier versions do not contain the vulnerable code, according to the company.
On RHEL 9, the fixed package is mod_http2-2.0.26-7.el9_9.1; for RHEL 10, it is mod_http2-2.0.29-5.el10_3.1. The Hacker News also reports fixes for RHEL 9.4 Update Services for SAP Solutions and for versions 9.6, 9.8, 10.0, and 10.2 Extended Update Support, through advisories RHSA-2026:98968, RHSA-2026:98954, RHSA-2026:98982, RHSA-2026:98953, and RHSA-2026:98979.
Status varies by distribution. Debian unstable (sid) is listed as fixed with apache2 2.4.71-1, while Debian bookworm, trixie, and forky are listed as vulnerable, with no fixed package indicated. For Amazon Linux 2 (Core), Amazon Linux 2023, and Amazon Linux 2027 Preview, the status is fix pending. Ubuntu's tracker did not have a page for this CVE when checked.
The Hacker News also lists Red Hat JBoss Core Services and Red Hat Hardened Images as affected, with no fix listed. Distribution package numbers do not necessarily match Apache project versions: each vendor publishes its own builds and packages.
Version 2.4.71 fixes two other flaws
The update is not limited to remote code execution. CVE-2026-106023 fixes a null pointer in mod_md that can cause a child process to crash while handling a request. It affects Apache 2.4.30–2.4.70, and RedesZone rates it Important; The Hacker News summary also describes it as an Important-severity flaw.
CVE-2026-109163 fixes a one-byte overwrite on the stack in mod_vhost_alias, classified as low severity. The flaw affects versions 2.4.69 and 2.4.70. The Japanese publication 窓の杜 lists these three CVEs as the vulnerabilities addressed by 2.4.71 and adds that the update includes fixes in mod_deflate, mod_dav, and mod_remoteip, as well as functionality improvements in mod_md.
Version 2.4.71 was released on November 11, 2026. The Apache HTTP Server project presents it as the latest available version in the stable 2.4.x branch. The Apache Software Foundation describes Apache HTTP Server as an open-source web server for modern operating systems.
What to do if you cannot update now
Apache's advisory does not propose a workaround. The definitive fix for users of project versions is to upgrade to 2.4.71; distributions with their own packages have corresponding versions and advisories. There is no fixed release for standalone mod_h2 builds.
As a temporary measure for those unable to upgrade, Wiz recommends removing h2 and h2c from the Protocols directive and leaving only Protocols http/1.1. The change should cover the global configuration and all virtual hosts. RedesZone warns that disabling HTTP/2 may affect performance and some clients, and advises testing it in a test environment first and monitoring logs for crashes or unusual worker process restarts.
The update follows other rounds of fixes: version 2.4.69 closed 20 CVEs in October, and 2.4.68 resolved another 13 in June, according to RedesZone. In May, 2.4.67 had fixed another HTTP/2 flaw, CVE-2026-23918. Having installed that version—or any later version up to 2.4.70—does not protect against CVE-2026-119618: all remain within the affected range.
Sources: RedesZone, The Hacker News, Apache HTTP Server Project, Red Hat, The Hacker News, 窓の杜
