TL;DR
Apache released HTTP Server 2.4.71 on November 11 to fix CVE-2026-119618, a critical flaw in mod_http2 that Apache says can lead to remote code execution. Servers running affected versions with HTTP/2 enabled are in scope; exploitation reports remain unclear, but Red Hat says public research has demonstrated a reliable exploit.
The Apache HTTP Server project released version 2.4.71 on November 11 to fix CVE-2026-119618, a critical vulnerability in its mod_http2 module that Apache says can lead to remote code execution. The affected range is Apache HTTP Server 2.4.55 through 2.4.70, but exposure depends on configuration: Red Hat says the flaw affects servers with HTTP/2 enabled.
Get business pricing on networking and server gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Apache describes the issue as a concurrent execution and synchronization flaw in the assign_headers() function, with the shorter advisory title “heap corruption and RCE in assign_headers.” Red Hat explains that a thread-safety problem can allow one thread to modify memory belonging to another, corrupting the server’s internal memory. Red Hat says a remote attacker able to reach the web server could use the flaw to execute arbitrary commands without authentication. It assigns a CVSS 3.1 score of 9.8; the source material says the NVD had not yet published its own score as of November 12.
Apache lists versions 2.4.55 through 2.4.70 as affected and 2.4.71 as fixed. The standalone mod_h2 module on GitHub is also affected from versions 2.0.8 through 2.0.42. Red Hat says the relevant configuration enables HTTP/2 using the Protocols directive, for h2 or h2c. It says servers serving only HTTP/1.1 are not affected. Apache documentation gives “Protocols http/1.1” as the default, so administrators should check their active configuration.
Vendor status varied on November 12. Red Hat shipped fixed packages on November 11, including advisories RHSA-2026:98981 for RHEL 9 and RHSA-2026:98978 for RHEL 10. It rates the issue Important for RHEL 9 and 10, citing allocator differences that it says make exploitation more complex; RHEL 8 and earlier are listed as unaffected. Red Hat JBoss Core Services and Red Hat Hardened Images were still listed as affected. Debian listed stable bookworm and trixie as vulnerable, while version 2.4.71-1 had reached its unstable sid branch. The source material reported no published Ubuntu or SUSE advisory at the time it was checked.
HTTP/2 Configuration Determines Exposure
The flaw matters because, if exploited as Red Hat describes, a network-reachable server could face unauthenticated remote command execution. That could put the server and services relying on it at risk. The practical scope is narrower than every Apache installation: according to Red Hat, the server must have HTTP/2 enabled and run an affected release or package.
Wiz, a cloud security company, said 64% of cloud environments in its data had resources vulnerable to this CVE and 51% had publicly exposed instances. Wiz cautioned that its figures did not account for configuration. They are measurements from Wiz’s own customer environments, not a count of servers confirmed exploitable. The figures signal potential reach, while administrators still need to verify their software version, package status and HTTP/2 settings.
Red Hat’s statement that public research has demonstrated a reliable exploit raises the urgency of applying the fix. The source material does not identify the researchers or link to public exploit code. Administrators should treat the vulnerability seriously while distinguishing that statement from confirmation of attacks in the wild.
Products Worth Considering
Jackery Explorer 1000 v2 Portable Power Station
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Jackery Solar Generator 1000 v2 with Two 100W Solar Panels, 1024Wh LiFePO4 Battery
As an affiliate, we earn on qualifying purchases.
Reports Led to the November Patch
Apache’s account credits Anthropic’s OSS Scanner and two researchers from Google Cloud Vulnerability Research with identifying the issue. Apache says Anthropic’s report arrived on October 26 and the Google Cloud researchers’ report on November 3. The CVE.org record reportedly shows that the identifier was reserved on October 30. Apache released the fix on November 11, making the reported interval from the first report to the patch 16 days.
The issue is in mod_http2, which handles HTTP/2 traffic for Apache. HTTP/2 allows multiple requests to be handled over a single connection, and Apache’s module processes parallel requests using multiple threads. That is relevant to the thread-safety flaw described in the advisories. The available source material does not provide technical exploit details, and Apache’s advisory does not publish them.
Distribution packages can differ from the upstream release, so the version shown by a package manager may not map directly to the upstream version number. Red Hat and Debian provide separate package advisories and status information. Administrators should check the advisory for their operating system and product as well as Apache’s upstream affected range.
““Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server’s mod_http2 in assign_headers() can lead to RCE.””
— Apache HTTP Server project
Exploit and Vendor Status Remain Open
The source material does not establish whether attackers have used CVE-2026-119618 in the wild. Wiz said on November 11 that it knew of no reports of exploitation and that no exploit was available at publication. Red Hat, however, said public research had demonstrated a reliable exploit against a default-configured server with mod_http2 enabled. The sources do not identify that research or clarify whether the exploit is publicly accessible.
CISA’s Known Exploited Vulnerabilities catalog did not list the CVE when checked on November 12. The catalog version cited was released before the CVE went public, so the absence of an entry does not resolve the question of current exploitation. The NVD score and published advisories for some distributions were also not available in the source material at that check time. Vendor package status may change after publication.
Administrators Should Check and Patch
Administrators should identify Apache HTTP Server and standalone mod_h2 versions across their systems, check whether HTTP/2 is enabled, and apply the fixed release or the relevant vendor package update. Those using distribution-managed software should follow their operating system’s advisory, since package availability and supported versions vary. If HTTP/2 is not enabled, Red Hat says the server is not affected by this issue, but administrators should confirm the actual configuration.
Security teams can monitor Apache, distribution advisories, the NVD and CISA’s exploited-vulnerability catalog for updates on package coverage, scoring and exploitation reports. The status described here reflects information checked on November 12, 2026; vendor notices and evidence about exploitation may change.
Key Questions
Which Apache versions are affected?
Apache lists HTTP Server 2.4.55 through 2.4.70 as affected and 2.4.71 as fixed. The standalone mod_h2 module from GitHub is affected from versions 2.0.8 through 2.0.42.
Does the flaw affect servers that only use HTTP/1.1?
Red Hat says servers serving only HTTP/1.1 are not affected. It says the issue affects servers with HTTP/2, h2 or h2c, enabled through the Protocols directive. Check the server’s active configuration.
Is CVE-2026-119618 being exploited?
The source material does not confirm in-the-wild attacks. Wiz reported no known exploitation on November 11, while Red Hat said public research had demonstrated a reliable exploit. The available information does not identify that research or establish whether the exploit is public.
What should administrators do?
Check the Apache or mod_h2 version and HTTP/2 configuration, then install Apache 2.4.71 or the applicable fixed package from your software vendor. Debian’s stable releases were still listed as vulnerable in the status checked on November 12, while Red Hat had shipped fixes for RHEL 9 and 10.
Source: Thorsten Meyer AI
