🔍 Read the full analysis: Apache HTTP/2 Flaw CVE-2026-119618: Start With These Checks on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Apache released HTTP Server 2.4.71 on November 11, 2026, fixing CVE-2026-119618, a critical mod_http2 flaw that Apache says can lead to remote code execution. Administrators should check whether HTTP/2 is enabled and install the fixed release or a vendor package; exposure depends on both the software version and configuration. Exploitation in the wild has not been confirmed in the cited sources, though Red Hat says public research demonstrated a reliable exploit.
Apache released HTTP Server 2.4.71 on November 11, fixing CVE-2026-119618, a critical flaw in the HTTP/2 module that Apache says can lead to remote code execution. The issue affects Apache HTTP Server versions 2.4.55 through 2.4.70 and specified standalone mod_h2 releases; servers must have HTTP/2 enabled to be exposed, according to Red Hat.
Apache describes the vulnerability as an improper synchronization flaw in the mod_http2 function assign_headers. In its advisory, the project says the flaw can cause heap corruption and remote code execution. Red Hat explains that a thread-safety problem can let one thread modify memory belonging to another, corrupting server memory. Red Hat says a remote attacker able to reach an affected server could execute commands without authentication.
The affected upstream ranges are Apache HTTP Server 2.4.55 through 2.4.70 and standalone mod_h2 versions 2.0.8 through 2.0.42. Apache’s fixed release is 2.4.71. Red Hat shipped fixed packages on November 11, including updates for RHEL 9 and 10. Its advisory rates the issue critical overall but important for those RHEL versions, citing allocator differences that increase exploitation complexity.
Exposure also depends on configuration: Red Hat says servers with HTTP/2 enabled through the Protocols directive, using h2 or h2c, are affected; servers serving only HTTP/1.1 are not. Debian’s stable bookworm and trixie branches were listed as vulnerable on November 12, while version 2.4.71-1 was available in unstable, sid. The source report found no published Ubuntu or SUSE advisory at that time. Administrators should check their distribution’s current security notice as well as the upstream version.
Apache HTTP/2 flaw Start with these checks
Apache fixed CVE-2026-119618 in HTTP Server 2.4.71. Check both the installed package and whether HTTP/2 is enabled to assess exposure.
Check both conditions
Exposure depends on software version and protocol configuration.
Inventory Apache HTTP Server and standalone mod_h2 versions across systems.
Check whether Protocols enables h2 or h2c. HTTP/1.1-only servers are not affected.
Upgrade upstream installs to 2.4.71 or install the fixed package for your distribution and release.
What the flaw could do
Apache describes an improper synchronization flaw in mod_http2’s assign_headers function.
- Heap corruption and remote code execution
- Red Hat says a reachable affected server could allow unauthenticated command execution
- Red Hat says public research demonstrated a reliable exploit
- Wiz reported no known in-the-wild exploitation as of November 11
Vendor status varies
Package versions and fix availability depend on the product and release branch.
| Product or source | Reported status | Administrator action |
|---|---|---|
| Apache HTTP Server | 2.4.71 fixes the flaw | Upgrade affected upstream installs |
| Red Hat | Fixed packages shipped November 11 for RHEL 9 and 10 | Follow the product advisory |
| Debian | Stable bookworm and trixie listed as vulnerable November 12; 2.4.71-1 in unstable | Recheck current branch notices |
Check HTTP/2 Before Patching
The flaw matters because it affects a widely used web server and, according to Red Hat, may permit unauthenticated remote command execution on reachable systems. That potential impact warrants prompt investigation, even though the cited sources do not establish that attacks are occurring in the wild. A server’s version alone does not settle exposure: administrators also need to determine whether HTTP/2 is enabled.
Wiz reported that 64% of cloud environments in its data had resources it considered vulnerable and 51% had publicly exposed instances. Those figures come from Wiz’s customer data, not a global census, and the company said its figures did not account for configuration. They should not be read as the share of servers that are exploitable. The practical priority is to inventory affected hosts, verify protocol settings, and apply the appropriate fixed package.
Distribution-managed installations need particular care. Package versions and fixes can differ from upstream releases, so a system may receive a vendor patch without appearing to run the same upstream version number. Conversely, a fix available in one branch does not mean it has reached every supported branch. Teams should follow their vendor’s advisory and package status rather than relying on a single generic version check.
Products Worth Considering
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds with Immersive Audio and Wireless Charging Case, Black
Samsung Galaxy Tab A11 8.7-Inch Wi-Fi Tablet, 64GB, 4GB RAM, 90Hz, Gray, with 20W Charger
DJI Mini 5 Pro Fly More Combo with DJI RC 2
As an affiliate, we earn on qualifying purchases.
Reports, Fix and Vendor Status
Apache credited two sources for identifying the flaw: Anthropic’s OSS Scanner and two researchers from Google Cloud Vulnerability Research. Apache’s timeline says Anthropic reported the issue on October 26 and the Google Cloud researchers reported it on November 3. The CVE number was reserved on October 30. Apache released the fix on November 11, a 16-day interval after the first report, according to the source’s timeline.
Apache’s default configuration documentation lists Protocols http/1.1; HTTP/2 must be enabled in configuration. That default is not a substitute for checking a live server, which may have been customized or may be managed by a distribution package. Red Hat said RHEL 8 and earlier were not affected, while Red Hat JBoss Core Services and Red Hat Hardened Images were still listed as affected when the report checked on November 12.
Evidence about exploitation was mixed. Wiz said on November 11 that it knew of no reports of exploitation in the wild and no available exploit at the time of publication. CISA’s Known Exploited Vulnerabilities catalog did not list the CVE when checked on November 12, but the cited catalog version predated public disclosure. Red Hat separately said public research had demonstrated a reliable exploit against a default-configured server with mod_http2 enabled. The available source material did not identify that research or link to public exploit code.
““Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server’s mod_http2 in assign_headers() can lead to RCE.””
— Apache HTTP Server project
Exploit Activity Remains Unverified
The cited reports do not confirm exploitation in the wild. Wiz reported no known attacks as of its November 11 publication, while CISA’s catalog had not yet listed the CVE when checked the next day. Because the catalog version cited was issued before the flaw became public, its omission is not evidence that exploitation had been ruled out.
Red Hat’s statement that public research demonstrated a reliable exploit raises concern, but the material does not name the researchers, describe when or under what conditions the demonstration occurred, or provide a public link. Apache did not publish exploit details in its advisory. The sources also do not provide a complete, current package status for every Linux distribution, downstream product, or managed hosting environment. Treat exploit status and vendor coverage as developing information, not settled facts.
Verify Packages and Protocol Settings
Administrators should identify Apache HTTP Server and standalone mod_h2 versions across their systems, then check whether h2 or h2c is enabled. For affected upstream installations, upgrade to Apache HTTP Server 2.4.71; for distribution-managed systems, install the vendor’s fixed package when available and confirm the vendor advisory covers that product and release. Recheck Debian stable and other distribution notices for updates beyond the status reported on November 12.
Security teams should also monitor Apache, distribution advisories and relevant vulnerability catalogs for new status information. The immediate next milestone is not a stated future event but confirmation that affected systems have received the correct fix and that exposure has been assessed. The source material does not give a deadline for further Apache or vendor notices, so the timing of additional advisories remains unknown.
Key Questions
What does CVE-2026-119618 affect?
It affects mod_http2 in Apache HTTP Server 2.4.55 through 2.4.70, and standalone mod_h2 versions 2.0.8 through 2.0.42. The upstream fixed release is Apache HTTP Server 2.4.71.
How can an administrator check whether a server is exposed?
Check the installed Apache or mod_h2 version and inspect the server’s Protocols configuration to see whether HTTP/2 is enabled with h2 or h2c. Red Hat says servers serving only HTTP/1.1 are not affected by this issue. Also check the applicable operating-system vendor advisory, since downstream package status may differ from upstream.
Is the flaw being exploited?
The cited sources do not confirm attacks in the wild. Wiz reported no known exploitation as of November 11, while Red Hat said public research had demonstrated a reliable exploit. Those statements address different evidence, and the available material does not resolve whether attackers are using the flaw.
What should users of Linux distribution packages do?
Follow the security advisory for the specific distribution and release, and install its fixed package when available. As reported on November 12, Debian’s stable bookworm and trixie branches were listed as vulnerable, while the fixed 2.4.71-1 package had reached unstable. Vendor status may change, so check for newer notices.
Source: ThorstenMeyerAI.com
