🔍 Read the full analysis: Is Your Apache HTTP/2 Setup Affected By CVE-2026-119618? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Apache released HTTP Server 2.4.71 on Nov. 11 to fix CVE-2026-119618, a critical mod_http2 flaw that Apache says can lead to remote code execution. Versions 2.4.55–2.4.70 and standalone mod_h2 2.0.8–2.0.42 are affected; the risk applies to servers with HTTP/2 enabled. Exploitation in the wild was not confirmed in the cited sources, but Red Hat said public research had demonstrated a reliable exploit.
The Apache HTTP Server project released version 2.4.71 on Nov. 11 to fix CVE-2026-119618, a critical flaw in its mod_http2 module that Apache says can lead to remote code execution. The issue affects Apache versions 2.4.55 through 2.4.70 and standalone mod_h2 versions 2.0.8 through 2.0.42, but exposure depends on HTTP/2 being enabled.
Apache describes the vulnerability as a shared-resource synchronization flaw in the assign_headers() function, with the advisory title “heap corruption and RCE in assign_headers.” In plainer terms, Red Hat says a thread-safety flaw could let one thread modify memory belonging to another, corrupting the server’s internal memory. Red Hat says a remote attacker able to reach an affected server could execute commands without authentication. It assigns the flaw a CVSS 3.1 score of 9.8; the NVD had not published its own score as of Nov. 12.
According to Red Hat, the issue affects servers with HTTP/2 (h2 or h2c) enabled through the Protocols directive. Servers serving only HTTP/1.1 are not affected. Apache’s documented default is “Protocols http/1.1,” but administrators should check their actual configuration rather than assume the default is in use. The affected upstream ranges are Apache HTTP Server 2.4.55–2.4.70 and GitHub’s standalone mod_h2 2.0.8–2.0.42; Apache lists 2.4.71 as the fixed release.
Package status differed by vendor when checked on Nov. 12. Red Hat shipped fixed packages on Nov. 11, including updates for RHEL 9 and 10; it says RHEL 8 and earlier are not affected. Red Hat still listed JBoss Core Services and Hardened Images as affected. Debian marked bookworm and trixie vulnerable, with fixed package 2.4.71-1 available only in unstable (sid). No Ubuntu or SUSE advisory had been found at that time.
Is Your Apache HTTP/2 Setup Affected? CVE-2026-119618
A critical flaw in mod_http2 can lead to remote code execution. Exposure depends on both the installed package and whether HTTP/2 is enabled.
Who may be affected
Check the installed package and whether h2 or h2c is enabled through the Protocols directive.
| Package | Affected range | Fix |
|---|---|---|
| Apache HTTP Server | 2.4.55–2.4.70 | 2.4.71 |
| Standalone mod_h2 | 2.0.8–2.0.42 | Check vendor update |
Why configuration matters
The flaw affects HTTP/2 handling; version numbers alone do not establish exposure.
- Affected versions may be exposed if reachable.
- Red Hat says a remote attacker could execute commands without authentication.
- Servers serving only HTTP/1.1 are not affected.
- Verify the actual Protocols configuration; do not assume the documented default.
Patch status varies by vendor
Vendor packages may include backported fixes, so check the relevant advisory.
Red Hat
Fixed packages shipped Nov. 11, including RHEL 9 and 10. RHEL 8 and earlier are listed as not affected.
Debian
Bookworm and trixie were marked vulnerable; fixed package 2.4.71-1 was available in unstable (sid).
Other products
Red Hat still listed JBoss Core Services and Hardened Images as affected. No Ubuntu or SUSE advisory had been found by Nov. 12.
What administrators should do
Confirm both package status and protocol configuration before assessing exposure.
Check Apache and mod_h2 packages, including your vendor’s advisory for backported fixes.
Look for h2 or h2c in the Protocols configuration and assess whether the server is reachable.
Update affected systems to Apache 2.4.71 or the fixed package supplied by your operating-system vendor.
Why HTTP/2 Servers Need Attention
The flaw matters because HTTP/2 can process many requests concurrently over one connection, and the vulnerability lies in how mod_http2 handles that work across threads. If the affected module is enabled on a reachable server, Red Hat says the flaw could permit unauthenticated remote command execution—a consequence that could put the server and services relying on it at risk.
Wiz reported that 64% of cloud environments in its data had resources vulnerable to the CVE and that 51% had publicly exposed instances. Those figures are Wiz’s customer-environment observations, not a census of all servers or proof that every counted instance can be exploited. Wiz explicitly said its figures did not account for configuration, which is especially relevant because HTTP/2 must be enabled for the issue to apply.
The practical response is to identify the installed Apache or mod_h2 version, verify whether HTTP/2 is enabled, and apply the appropriate upstream or distribution update. Where a vendor has not yet issued a package, administrators should monitor its security advisory and assess exposure using their own configuration and inventory.
Products Worth Considering
DJI Mini 4 Pro Fly More Combo with DJI RC 2
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
Apple Watch Series 12 GPS 42mm Smartwatch
As an affiliate, we earn on qualifying purchases.
Reports, Fix and Vendor Status
The Apache security team received a report from Anthropic’s OSS Scanner on Oct. 26, according to the project, and a report from two Google Cloud Vulnerability Research researchers on Nov. 3. The CVE number was reserved on Oct. 30. Apache released the fix on Nov. 11, 16 days after the first report. Apache credited both the AI scanner and the Google Cloud researchers; the reported timeline does not establish that the scanner alone found or validated the flaw.
The vulnerability is in mod_http2, Apache’s HTTP/2 module. HTTP/2 support is configured rather than necessarily active by default, according to the supplied Apache documentation. That distinction means version numbers alone do not establish whether a particular server is exposed: the installed package, vendor backports, and enabled protocols all matter.
Reports on exploitation were not aligned. Wiz said on Nov. 11 that it knew of no exploit available and no reports of exploitation in the wild. CISA’s Known Exploited Vulnerabilities catalog did not include the CVE when checked Nov. 12, although the cited catalog version predated the public disclosure. Red Hat, meanwhile, said public research had demonstrated a reliable exploit against a default-configured server with mod_http2 enabled. The sources provided no public exploit code or further details of that research.
““Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server’s mod_http2 in assign_headers() can lead to RCE.””
— Apache HTTP Server project
Exploit Activity and Package Gaps
Confirmed exploitation in the wild was not established by the sources available on Nov. 12. Wiz reported no known in-the-wild attacks, and the CVE was absent from the CISA catalog checked. But that catalog version was issued before the CVE became public, while Red Hat said reliable exploit research existed. These statements do not establish whether attackers have used the flaw.
Red Hat did not name the researchers behind the reported exploit or provide details in the material cited here. The advisories also did not provide public exploit code. Distribution coverage remained incomplete: Debian stable was still listed as vulnerable, and no Ubuntu or SUSE advisory had been located by the source at the time of its check. Administrators should confirm current package status with their vendor, since updates may have appeared after Nov. 12.
It is also not possible to infer how many individual servers are exploitable from Wiz’s percentages. Its data concerns customer cloud environments and does not account for configuration. A vulnerable package on a host does not by itself confirm that HTTP/2 is enabled or that the server is reachable.
Check Configuration and Patch Status
Administrators should check Apache’s installed version and the relevant distribution package, then verify whether h2 or h2c is enabled in the Protocols configuration. Systems running affected versions with HTTP/2 enabled should be updated to Apache 2.4.71 or to the fixed package supplied by their operating-system vendor. Because vendors may backport fixes without matching the upstream version number, package-specific advisories matter.
Organizations using Debian bookworm or trixie, or products Red Hat still listed as affected, should follow vendor notices for an updated package and reassess exposure when it becomes available. Teams should also revisit the CISA catalog and vendor advisories for changes to exploitation status. The next confirmed developments will be further distribution updates and any new public information clarifying the reported exploit research or observed attacks.
Key Questions
Which Apache HTTP Server versions are affected?
Apache lists versions 2.4.55 through 2.4.70 as affected. The upstream fixed release is 2.4.71. Vendor packages may contain backported fixes, so check the relevant distribution advisory as well as the upstream version number.
Does CVE-2026-119618 affect servers that use only HTTP/1.1?
According to Red Hat, servers serving only HTTP/1.1 are not affected. The issue applies when HTTP/2, using h2 or h2c, is enabled. Check the server’s active configuration rather than relying only on the documented default.
Is there confirmed exploitation in the wild?
The sources available on Nov. 12 did not confirm attacks in the wild. Wiz said it had no reports of exploitation, while Red Hat said public research had demonstrated a reliable exploit. The available information does not resolve whether attackers have used it.
What should administrators do?
Check the installed Apache or mod_h2 package, confirm whether HTTP/2 is enabled, and install Apache 2.4.71 or the vendor’s fixed package where available. If a distribution still lists the system as vulnerable, follow its security advisory for update timing.
Source: ThorstenMeyerAI.com
