Apache web servers with HTTP/2 on can be taken over without a login. Install 2.4.71 this week

The Apache Software Foundation released Apache HTTP Server 2.4.71 on Wednesday to fix CVE-2026-119618, a flaw in the HTTP/2 module that can let an outsider with no login run code on the server. Red Hat scores it 9.8.

Apache is one of the most common web servers on the internet and inside company networks. If yours speaks HTTP/2, and many do because modern browsers prefer it, this is the update to schedule first.

Apache’s web server has a 9.8 bug in its HTTP/2 module that needs no login. Version 2.4.71 fixes it. If you can’t patch today, turn HTTP/2 off.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Apache fixes a critical HTTP/2 bug in its web server

The bug is a race condition in mod_http2’s assign_headers() function. When several HTTP/2 requests arrive at once on the same connection, one worker thread can write into memory that belongs to another, corrupting the heap. Apache rates it critical; Red Hat says an attacker could use it to run commands and take control of the server process.

• Affected: Apache HTTP Server 2.4.55 through 2.4.70, and the standalone mod_h2 module from GitHub, versions 2.0.8 through 2.0.42.
• Fixed: 2.4.71, released November 11. Debian shipped 2.4.71 packages for Trixie and Bookworm the same week.
• Found by: Anthropic’s OSS Scanner, which reported it on October 26, and Google Cloud Vulnerability Research, which reported it on November 3.
• Not affected: servers that serve HTTP/1.1 only, and Red Hat Enterprise Linux 8 and earlier.

Any Apache server from 2.4.55 to 2.4.70 with HTTP/2 on

Wiz says 64% of the cloud environments it sees run an affected Apache version and 51% have one exposed to the internet. Those numbers ignore configuration, so not all of them have HTTP/2 enabled, but it shows how many teams need to check.

No attacks have been reported. A proof of concept on GitHub crashes Apache but does not run code, according to SecurityWeek. Red Hat, though, says public research has shown a reliable exploit against a default server with mod_http2 enabled, so the gap between disclosure and attacks may be short.

Wordfence’s maker Defiant points out that WordPress updates won’t help here: the bug sits in the web server underneath, not in the site.

Install 2.4.71 or your distro’s package, or turn HTTP/2 off

• List every Apache server and its version. On each one, run apachectl -M | grep http2 to see whether mod_http2 is loaded, and check the Protocols line for h2 or h2c.
• Upgrade internet-facing servers first, to 2.4.71 from Apache or your distribution’s patched package. On Debian that is 2.4.71-1~deb13u1 (Trixie) or 2.4.71-1~deb12u1 (Bookworm).
• If you can’t patch today, set Protocols http/1.1 and reload Apache. Browsers fall back to HTTP/1.1 on their own.
• Ask your hosting provider and appliance vendors whether their Apache builds are affected. Many load balancers, control panels and products bundle their own copy.
• Sorting this against everything else due this week? Our patch priority checklist puts internet-facing, no-login bugs like this one at the top.

Details

• CVE-2026-119618: mod_http2 heap corruption and RCE in assign_headers(). Apache rating: critical. Red Hat CVSS 3.1: 9.8 (AV:N/AC:L/PR:N/UI:N). Affects 2.4.55 through 2.4.70; mod_h2 2.0.8 through 2.0.42.
• Red Hat: rated Important, not Critical, on RHEL 9 and RHEL 10 because their mod_http2 gives each HTTP/2 stream its own allocator. RHEL 8 and earlier are not affected.
• Ubuntu: all releases listed as “needs evaluation” on November 12. Ubuntu notes it has backported newer mod_h2 code into older apache2 packages, so the version number alone may not tell you whether you are exposed.
• Also in 2.4.71: CVE-2026-106023 (important, mod_md crash, 2.4.30 to 2.4.70) and CVE-2026-109163 (low, mod_vhost_alias, 2.4.69 and 2.4.70).
• Exploitation: none reported as of November 12.

Hunt / verify

• From outside, test each public site with curl -sI --http2 -o /dev/null -w "%{http_version}\n" followed by the site’s address. A result of 2 means HTTP/2 is on.
• Watch error logs for repeated child process crashes (segmentation faults) since November 11, which is what the public proof of concept causes.
• In container images, check the Apache version baked into each image, not just the host.

Source: Apache HTTP Server 2.4 vulnerabilities; Red Hat CVE-2026-119618

Sources

• Apache HTTP Server Project: Apache HTTP Server 2.4 vulnerabilities (fixed in 2.4.71)
• Red Hat Customer Portal: CVE-2026-119618
• Wiz: Critical RCE Vulnerability in Apache HTTP Server (CVE-2026-119618)
• SecurityWeek: Apache Patches Critical HTTP Server RCE Found by Anthropic, Google
• Debian security tracker: CVE-2026-119618
• Ubuntu: CVE-2026-119618

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].