🔍 Read the full analysis: Apache HTTP/2 CVE-2026-119618: Risks And Recommended Actions on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Apache released HTTP Server 2.4.71 on November 11 to fix CVE-2026-119618, a critical flaw in mod_http2 that Apache says can lead to remote code execution. The issue affects specified Apache and standalone mod_h2 versions when HTTP/2 is enabled; reports of exploitation are unconfirmed, but Red Hat says public research demonstrated a reliable exploit.
The Apache HTTP Server project released version 2.4.71 on November 11 to fix CVE-2026-119618, a critical flaw in its HTTP/2 module that Apache says can lead to remote code execution. Administrators should check whether HTTP/2 is enabled and install the fixed version or an applicable vendor package; whether attackers are exploiting the flaw in the wild is not confirmed.
Apache identifies affected versions as HTTP Server 2.4.55 through 2.4.70 and standalone mod_h2 versions 2.0.8 through 2.0.42. The vulnerability is in the mod_http2 function assign_headers. Apache describes it as a concurrent execution flaw involving improper synchronization of a shared resource, with potential for heap corruption and remote code execution.
The issue applies to servers with HTTP/2 enabled, including configurations using h2 or h2c through the Protocols directive. Red Hat says servers serving only HTTP/1.1 are not affected. Administrators should inspect their actual configuration rather than assume exposure from the server version alone. Apache lists 2.4.71 as the upstream fix.
Vendor status differed as of November 12. Red Hat shipped fixed packages on November 11, including advisories for RHEL 9 and 10; it says RHEL 8 and earlier are not affected. Red Hat listed JBoss Core Services and Hardened Images as affected. Debian listed bookworm and trixie as vulnerable, with fixed package 2.4.71-1 available in unstable, sid. The source reported no published Ubuntu or SUSE advisory at that time.
Apache HTTP/2 CVE-2026-119618 Risks and actions
A critical flaw in mod_http2 can lead to remote code execution. Exposure depends on the affected version and whether HTTP/2 is enabled.
Check whether you are exposed
Version and configuration both matter; Wiz’s figures do not account for configuration.
- HTTP Server 2.4.55 through 2.4.70
- Standalone mod_h2 2.0.8 through 2.0.42
- HTTP/2 enabled, including h2 or h2c
- Servers serving only HTTP/1.1
- RHEL 8 and earlier
Why it matters
The flaw is in mod_http2’s assign_headers function and involves improper synchronization of a shared resource.
Memory corruption
Apache says the flaw can cause heap corruption and lead to remote code execution.
Reliable exploit demonstrated
Red Hat reports public research demonstrated a reliable exploit against a default-configured server with mod_http2 enabled.
Patch and verify
Use the upstream fix or a vendor-confirmed fixed package, then confirm the running service uses it.
Check Apache HTTP Server and standalone mod_h2 installations.
Review whether h2 or h2c is enabled in the Protocols configuration.
Install 2.4.71 or a vendor-provided fix, then verify through normal patch management.
Vendor status snapshot
Package availability differed across vendors as of November 12, 2026.
| Vendor or package | Status reported |
|---|---|
| Red Hat | Fixed packages shipped November 11 for RHEL 9 and 10; JBoss Core Services and Hardened Images listed as affected |
| Debian | Bookworm and trixie listed as vulnerable; 2.4.71-1 available in unstable, sid |
| Ubuntu and SUSE | No published advisory found at that time |
HTTP/2 Exposure Requires Prompt Patching
The flaw matters because Apache is widely used to serve websites and applications, and Red Hat says a remote attacker able to reach an affected web server could exploit it to run arbitrary commands without authentication. Red Hat assigned a CVSS 3.1 score of 9.8 out of 10. That is Red Hat’s assessment; the National Vulnerability Database had not published its own score when the source checked.
Exposure depends on both the software version and configuration. An affected release with HTTP/2 enabled warrants urgent attention, while a server configured for HTTP/1.1 only is not affected according to Red Hat. Cloud security company Wiz reported that 64% of cloud environments in its data had resources vulnerable to the CVE and 51% had publicly exposed instances. Wiz cautioned that its figures do not account for configuration; they are not counts of confirmed exploitable servers.
The practical priority is to identify affected systems, apply the fixed upstream release or a distribution-provided update, and verify that the running service uses the patched package. If a patch cannot be applied immediately, administrators should consult their vendor’s advisory for temporary mitigation guidance rather than assume that disabling HTTP/2 is required or sufficient in every deployment.
Products Worth Considering
DJI Osmo Pocket 3 Vlogging Camera with 1-Inch CMOS Sensor and 4K/120fps Video
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1, DisplayPort 1.4, Black
Bose TV Speaker (2nd Gen) Compact Soundbar with Bluetooth and HDMI Connectivity, Black
As an affiliate, we earn on qualifying purchases.
Reports, Disclosure and Patch Timeline
Apache’s advisory credits the discovery to Anthropic’s OSS Scanner and two researchers from Google Cloud Vulnerability Research. The source says Anthropic’s report reached Apache on October 26, and the Google Cloud report arrived November 3. A CVE number was reserved on October 30, according to the CVE record.
Apache released the fix on November 11, when the advisory was also posted to the oss-security mailing list. Red Hat published its CVE entry the same day, and the CVE record went live. The interval from Anthropic’s report to the release was 16 days, based on those reported dates.
Apache’s notice does not provide exploit details, and the source reports no public exploit code linked from the advisories. Red Hat’s severity rating for RHEL 9 and 10 is “Important,” rather than “Critical,” because it says those packages use separate allocators for HTTP/2 streams, increasing the complexity of exploitation. That product-specific assessment does not change Apache’s critical rating for the vulnerability overall.
““Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server’s mod_http2 in assign_headers() can lead to RCE.””
— Apache HTTP Server project
Exploit Activity and Vendor Coverage
In-the-wild exploitation is not confirmed by the cited material. Wiz said on November 11 that it knew of no available exploit and no reports of attacks. CISA’s Known Exploited Vulnerabilities catalog did not include the CVE when checked on November 12, but the cited catalog version predated public disclosure, so its absence does not establish that exploitation is not occurring.
Red Hat’s account that public research demonstrated a reliable exploit raises concern, but the source does not identify the researchers, provide a publication, or link to exploit code. It is therefore unclear whether the research is publicly accessible or whether the demonstrated method has been used against real systems. Administrators should treat the risk seriously without describing attacks as confirmed.
Distribution coverage was also incomplete at the time of the report. Debian stable releases were still listed as vulnerable, while the fixed package was in unstable; no Ubuntu or SUSE advisory had been found. Those statuses can change, and the source’s checks are a snapshot from November 12, not a guarantee of current package availability.
Verify Packages and Follow Advisories
Administrators should inventory Apache HTTP Server and standalone mod_h2 versions, check whether h2 or h2c is enabled, and update affected installations to 2.4.71 or a vendor-confirmed fixed package. Systems managed through Linux distributions should follow the distribution’s package advisory and verify installation through their normal patch-management process. Teams should also recheck vendor notices, particularly where an advisory was not yet available on November 12.
Apache and vendors may publish further technical details, package updates, or revised severity guidance. Security teams should monitor the CISA catalog and trusted vendor advisories for changes in exploitation status. The current source material does not establish a confirmed attack campaign or a specific date for additional disclosures.
Key Questions
What is CVE-2026-119618?
It is a critical vulnerability in Apache’s mod_http2. Apache says the flaw in assign_headers can cause heap corruption and lead to remote code execution.
Which Apache versions are affected?
Apache lists HTTP Server 2.4.55 through 2.4.70 and standalone mod_h2 versions 2.0.8 through 2.0.42. The upstream fixed release is 2.4.71. Check vendor advisories for distribution-specific package status.
Are HTTP/1.1-only servers affected?
Red Hat says servers serving only HTTP/1.1 are not affected. The issue applies when HTTP/2 is enabled, so administrators should check their Protocols configuration and not rely solely on defaults.
Is the vulnerability being exploited?
The cited sources do not confirm attacks in the wild. Wiz reported no known exploitation on November 11, while Red Hat said public research had demonstrated a reliable exploit. The available information does not establish that the research has been used in attacks.
What should administrators do now?
Identify affected versions and HTTP/2-enabled systems, then install Apache 2.4.71 or a vendor-confirmed fix. Follow the relevant operating-system or product advisory and check for updates, since vendor coverage was still developing on November 12.
Source: ThorstenMeyerAI.com
