CRITICAL: Apache HTTP/2 Bug CVE-2026-119618 Allows Unauthenticated RCE

If you have been running Apache HTTP Server long enough, you know the drill. A new release drops, somebody reads the changelog, and most of the time the fixes are the sort of thing you schedule for the next maintenance window. This is not one of those times. The Apache Software Foundation shipped version 2.4.71 on November 11, and the headline fix is CVE-2026-119618, a critical flaw in mod_http2 that can hand an unauthenticated remote attacker code execution on the server. Red Hat scores it at 9.8 on the CVSS scale. If your web servers speak HTTP/2, and in 2026 a lot of them do, this one goes to the top of the pile.

The reason this matters so much is simple math. Apache still sits in front of an enormous share of the internet, from corporate portals and customer login pages to the forgotten intranet box in a closet that nobody has touched since the last office move. HTTP/2 has been the expected default for years now, and plenty of admins enabled it by copying a Protocols line from a tuning guide without thinking twice. That means the vulnerable code path is very likely live on servers you would not immediately think of as being at risk.

What Is Actually Broken

According to the Apache advisory, the bug lives in a function called assign_headers() inside the mod_http2 module. The project describes it as concurrent execution using a shared resource with improper synchronization, which is the formal way of saying two threads are touching the same memory without coordinating properly. The practical result is heap corruption, and heap corruption in a network facing service that processes attacker supplied input is about as close to a recipe for remote code execution as you can get. The attacker needs no credentials and no user interaction. They just need to reach the server and talk HTTP/2 to it.

The affected range is Apache HTTP Server 2.4.55 through 2.4.70. If you build the standalone mod_h2 module from GitHub, versions 2.0.8 through 2.0.42 are affected as well, and that group is in a worse spot than everyone else. The standalone repository was archived and set to read only back in June, and no fixed release exists for it. If that describes any of your systems, your options are to move to the module bundled with the fixed Apache release or turn HTTP/2 off.

There is one detail worth calling out for anyone who felt good about patching earlier this year. CVE-2026-23918, a separate HTTP/2 flaw, was fixed back in 2.4.67 in May. Servers that took that update and stopped there, sitting anywhere from 2.4.67 up to 2.4.70, are still exposed to this new bug. Being patched in May does not mean being patched in November.

Who Found It and How Bad Exploitation Looks

The flaw was reported to the Apache security team on October 26 by Anthropic's OSS Scanner, a free service that uses AI models to hunt for bugs in open source projects, under the internal identifier ANT-2026-MAPKT6MZ. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research independently reported the same issue on November 3. Two separate teams landing on the same bug within about a week tells you the code was ripe for discovery, and it should also tell you that the people looking for bugs with less charitable intentions are probably not far behind.

On exploitation, the picture is a little mixed, and it is worth being honest about that. Red Hat's write up states that public research has demonstrated a reliable exploit against a default configuration with mod_http2 enabled, though it does not point to that research directly. Wiz, on the other hand, said later the same day that it was not aware of any available exploit and had seen no exploitation in the wild. As of this writing, there is no confirmed in the wild activity and the bug is not on the CISA Known Exploited Vulnerabilities catalog.

Red Hat also rated the issue Important rather than Critical for its own packages, noting that each HTTP/2 stream gets its own memory allocator, which makes reliable exploitation much harder. That is a reasonable engineering argument and I do not dispute it. I would also point out that "much harder" has a funny way of turning into "weaponized" once a patch diff is public and a few motivated researchers start comparing notes. The fix commit is already sitting in the Apache repository for anyone to read. Plan accordingly.

Distribution Status Is All Over the Map

Here is where things get messy for anyone not compiling Apache from source. Red Hat has fixed packages out for Red Hat Enterprise Linux 9 in mod_http2 version 2.0.26 under RHSA-2026:98981, and for RHEL 10 in mod_http2 version 2.0.29 under RHSA-2026:98978, along with Extended Update Support streams for 9.4 SAP Solutions, 9.6, 9.8, 10.0 and 10.2 as well. RHEL 6, 7 and 8 do not contain the vulnerable code at all, which is one of the rare occasions where running something older actually works in your favor. Red Hat JBoss Core Services and Red Hat Hardened Images are listed as affected with no fix yet.

Debian has a fixed package in unstable, but bookworm, trixie and forky were still listed as vulnerable without a fix at the time of reporting. Amazon Linux 2, Amazon Linux 2023 and the Amazon Linux 2027 preview show fixes as pending. Ubuntu had not yet published a status page for the CVE. In other words, depending on your distribution, you may not be able to simply run your package manager today and call it done.

The same 2.4.71 release also fixes two lesser issues worth knowing about. CVE-2026-106023 is a NULL pointer dereference in mod_md, rated important, that can crash child processes and affects versions back to 2.4.30. CVE-2026-109163 is a one byte stack buffer overwrite in mod_vhost_alias, rated low, affecting 2.4.69 and 2.4.70. Neither is in the same league as the HTTP/2 bug, but you get both fixes for free when you update.

What To Do Right Now

The first job is figuring out where you are exposed. Run httpd -v or apache2 -v across your fleet to pull versions, then search your configuration for the Protocols directive and look for h2 or h2c. Check the server wide configuration and every virtual host, because HTTP/2 can be enabled in either place and it is common to find one forgotten vhost doing its own thing. An external scan for ALPN negotiation of h2 against your public IP space will confirm what the internet actually sees, which is not always what the config files claim.

Where you can, upgrade to Apache 2.4.71 or your distribution's fixed package and restart the service. A graceful reload is fine for most environments, but make sure the new binary is actually the one running afterward. I have lost count of how many "patched" servers turned out to still be running the old process because nobody restarted anything.

Where you cannot upgrade yet, the Apache advisory itself offers no workaround, but Wiz recommends removing h2 and h2c from the Protocols directive and leaving only http/1.1 in place. That will cost you some performance on busy sites and your web team will grumble, but a slower site beats a compromised one. This is also the only real option for anyone stuck on a standalone mod_h2 build. If Apache sits behind a reverse proxy, load balancer or CDN that terminates HTTP/2 and speaks HTTP/1.1 to the backend, your exposure is lower, but verify that assumption rather than trusting the network diagram from three years ago.

For detection, watch for Apache child processes crashing with segmentation faults in the error log, especially in bursts, since failed heap corruption attempts tend to be noisy before a successful one is quiet. Unexpected child processes spawned by httpd or apache2, such as shells, curl, wget or interpreters, should page someone immediately. Outbound connections from web server hosts to unfamiliar addresses deserve the same attention. Your EDR should already be flagging web server processes that spawn command shells, and if it is not, now is a good time to fix that rule.

The Bigger Picture

This is the second critical HTTP/2 flaw in Apache this year, and it arrives in a month that has already given us remote code execution bugs in Linux TCP handling, OpenSSH and a pile of other foundational software. The common thread is that AI assisted bug hunting is getting very good at finding memory safety issues in old, complicated C code, and the timeline from disclosure to exploitation keeps shrinking. Treat internet facing web servers as tier one patch targets with a 48 to 72 hour window for critical fixes, not something that waits for the monthly cycle.

If an IT provider manages your systems

Apache web servers often run inside vendor portals, appliances and old websites, so you may have one without knowing it. This flaw, CVE-2026-119618, lets an attacker with no password take over an affected server.

• Which of our web servers, appliances or hosted sites run Apache 2.4.55 through 2.4.70 with HTTP/2 turned on?
• Have they been updated to Apache 2.4.71 or a fixed vendor package, and was the service restarted afterward?
• Where no fix is available yet, have you turned off HTTP/2 for now?

A good answer names specific servers, versions and dates. It also confirms that someone checked what the internet can actually reach, not just the configuration files. If nobody can tell you how many Apache servers you have, vulnerability scanning will find them before an attacker does.

If you are an IT provider yourself, see how we partner with MSPs.