🔍 Read the full analysis: Critical Apache HTTP/2 Flaw CVE-2026-119618: Who Needs To Act? on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Apache released HTTP Server 2.4.71 on November 11 to fix CVE-2026-119618, a critical flaw in mod_http2 that Apache says can lead to remote code execution. Administrators should check whether HTTP/2 is enabled and apply the fixed release or a vendor security update; affected versions include Apache HTTP Server 2.4.55–2.4.70.
Public information does not establish whether the flaw is being exploited in attacks. Red Hat says public research demonstrated a reliable exploit, while Wiz reported no known in-the-wild exploitation as of November 11.
The Apache HTTP Server project released version 2.4.71 on November 11 to fix CVE-2026-119618, a critical flaw in the mod_http2 module that Apache says can lead to remote code execution. Administrators running affected Apache versions should check whether HTTP/2 is enabled and install the upstream release or a fixed package from their operating-system vendor.
Apache lists HTTP Server 2.4.55 through 2.4.70 as affected, along with standalone mod_h2 releases from GitHub numbered 2.0.8 through 2.0.42. The issue is in assign_headers(), where a concurrent-execution flaw can corrupt heap memory. Red Hat describes the underlying problem as a thread-safety flaw in which one thread can modify memory belonging to another.
Exposure depends on configuration as well as version. Red Hat says the issue affects servers with HTTP/2 enabled through the Protocols directive, including h2 or h2c; servers serving only HTTP/1.1 are not affected. Apache documentation lists HTTP/1.1 as the default protocol setting, but administrators should inspect their actual configuration rather than assume the default remains in place.
Red Hat shipped fixes on November 11, including updates for RHEL 9 and 10. The vendor rates the flaw critical overall but important for those RHEL releases, citing allocator behavior that makes exploitation more complex. Red Hat lists RHEL 8 and earlier as not affected, while Red Hat JBoss Core Services and Red Hat Hardened Images were still listed as affected. Debian’s stable bookworm and trixie releases were listed as vulnerable in the source report; version 2.4.71-1 had reached Debian unstable, sid. The report found no published Ubuntu or SUSE advisory at its November 12 check.
Apache HTTP/2 flaw who needs to act?
Apache released a fix for CVE-2026-119618, a critical flaw that can lead to remote code execution. Check both your server version and whether HTTP/2 is enabled.
Who is exposed?
Exposure depends on software version and server configuration.
- Apache HTTP Server 2.4.55–2.4.70
- Standalone mod_h2 2.0.8–2.0.42
- HTTP/2 enabled through the Protocols directive
- Check for h2 or h2c in Protocols
- HTTP/1.1-only servers are not affected, according to Red Hat
- Inspect actual settings; defaults may have changed
What the flaw can do
The issue is in mod_http2’s assign_headers() function.
Memory corruption
A thread-safety flaw can let one thread modify memory belonging to another.
Remote code execution
Apache says the flaw can lead to remote code execution; Red Hat says exploitation can be unauthenticated.
Patch and disclosure
Apache released the upstream fix on November 11, 2026.
What administrators should do
Use vendor package status as well as upstream version numbers.
Check Apache HTTP Server and standalone mod_h2 versions.
Review the Protocols directive for h2 or h2c.
Install Apache 2.4.71 or the fixed package provided by your operating-system vendor.
Why HTTP/2 Servers Need Attention
The flaw matters because a remotely reachable web server with the affected module and HTTP/2 enabled could face a path to arbitrary command execution. Red Hat says an attacker could exploit it without authentication. That description makes prompt patching important for internet-facing systems, although the available reporting does not establish that every affected configuration is exploitable in the same way.
Cloud security company Wiz reported that 64% of cloud environments in its data had resources vulnerable to this CVE and that 51% had publicly exposed instances. Wiz cautioned that its figures did not account for configuration. They describe its customer environments, not a count of confirmed exploitable servers across the internet, and should not be read as a general prevalence estimate.
The fix also comes with an unsettled exploitation picture. Wiz said on November 11 that it knew of no exploit or in-the-wild attacks. Red Hat, however, said public research had demonstrated a reliable exploit against a default-configured server with mod_http2 enabled. Those statements are not necessarily incompatible: research demonstrating an exploit does not by itself confirm criminal use in real attacks.
Popular right now
Roborock RockNeo Q110H Wire-Free Robot Lawn Mower
Vitamix 5200 Blender with 64 oz Container, Black
Bose QuietComfort Ultra Headphones (2nd Gen), Wireless Noise-Cancelling Over-Ear Headphones with Spatial Audio, Driftwood Sand
As an affiliate, we earn on qualifying purchases.
Patch and Disclosure Timeline
Apache’s advisory describes the vulnerability as a concurrent execution using a shared resource with improper synchronization in mod_http2 and says it can lead to remote code execution. Apache credited two sources for reporting it: Anthropic’s OSS Scanner and two researchers from Google Cloud Vulnerability Research. According to the source report, Anthropic’s report arrived on October 26 and the Google Cloud researchers’ report on November 3.
The CVE number was reserved on October 30, according to its record. Apache fixed the issue in the 2.4.x branch and released 2.4.71 on November 11. Apache’s Eric Covener posted the advisory to the oss-security mailing list that day, followed by a Red Hat CVE entry and publication of the CVE record. This sequence gives administrators a short interval between public disclosure and the release of the upstream fix.
The vulnerability’s discovery by an AI scanner is part of the disclosure record, not evidence that the flaw has been exploited or that AI tools found every related defect. Apache also credited human researchers at Google Cloud. The practical response for operators remains the same regardless of how the reports were produced: verify affected software and configuration, then apply the relevant vendor fix.
“Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server’s mod_http2 in assign_headers() can lead to RCE.”
— Apache HTTP Server project advisory
Exploit Status and Vendor Coverage
It is not confirmed whether attackers are exploiting the flaw. Wiz reported no known in-the-wild exploitation on November 11. CISA’s Known Exploited Vulnerabilities catalog did not list the CVE when checked on November 12, but the catalog version cited had been released before the CVE became public, so its omission does not settle the question. Red Hat’s report of reliable exploit research does not establish that attacks are occurring.
The public advisories cited in the source report do not provide exploit code or enough technical detail to independently assess the claimed exploit. Red Hat did not identify the research behind its statement. Vendor coverage also remained incomplete at the time of the check: Debian stable was still listed as vulnerable, and no Ubuntu or SUSE advisory had been found by the report’s author. Package status can change, and distribution versions may include fixes through backported patches rather than a change to the upstream version number.
The reported cloud exposure figures also have limits. Wiz said its percentages came from its own customer data and did not account for configuration. The figures therefore do not show how many servers could actually be exploited, nor do they establish exposure across all cloud environments.
What Administrators Should Check
Administrators should first identify Apache HTTP Server and standalone mod_h2 versions, then inspect the Protocols configuration to determine whether HTTP/2 is enabled. Systems running an affected version with HTTP/2 enabled should receive Apache 2.4.71 or the appropriate fixed package from their vendor. Operators using distribution packages should follow that vendor’s advisory and confirm the installed package’s security status, rather than relying only on the upstream version string.
Teams should also check vendor notices for systems that were still marked affected or lacked an advisory in the November 12 report. Red Hat listed JBoss Core Services and Hardened Images as affected, while Debian stable remained vulnerable at the time described. Administrators should reassess those products when vendors publish updates. Apache, Linux distributors, CISA and security researchers may provide further information on exploit activity and package availability.
Key Questions
Which Apache versions are affected by CVE-2026-119618?
Apache lists HTTP Server 2.4.55 through 2.4.70 as affected. Standalone mod_h2 releases from GitHub 2.0.8 through 2.0.42 are also listed. Apache 2.4.71 is the upstream fixed release.
Does the flaw affect servers that use only HTTP/1.1?
Red Hat says servers serving only HTTP/1.1 are not affected. The reported exposure applies when HTTP/2 is enabled through Apache’s Protocols directive. Administrators should verify the live configuration.
Is CVE-2026-119618 being exploited in attacks?
That was not confirmed in the reporting available on November 12. Wiz reported no known in-the-wild exploitation, while Red Hat said public research had demonstrated a reliable exploit. The source report found no public exploit code linked from the advisories.
What should affected administrators do?
Check the Apache or mod_h2 version and whether HTTP/2 is enabled. Install Apache 2.4.71 or a vendor-provided fixed package, and check the relevant distribution or product advisory for package-specific instructions and status.
Source: ThorstenMeyerAI.com
