The Apache HTTP Server Project released version 2.4.71 on Wednesday fixing a critical flaw in its HTTP/2 module, mod_http2, that can lead to remote code execution.
The bug, tracked as CVE-2026-119618, sits in mod_http2 and affects Apache versions 2.4.55 through 2.4.70.
Apache’s own description says it “can lead to RCE.” That abbreviation stands for remote code execution: an outsider running commands on the server.
Red Hat Cites Demonstrated Exploits While Wiz Says None Exist
Assessments of exploitability diverge. Red Hat rates the flaw 9.8 out of 10 on the CVSS scale and says public research has demonstrated a reliable exploit against a default configuration with mod_http2 enabled, The Hacker News reported. Red Hat does not name or link that research.
Wiz, the security firm, said the same day that no exploit is available and no exploitation in the wild has been reported. Apache’s advisory does not discuss exploitation.
Rescana said the flaw was absent from CISA’s Known Exploited Vulnerabilities (KEV) catalog, the U.S. list of flaws confirmed as attacked, when it checked on November 11. Apache published no CVSS score, and the NVD entry was in “Received” status with no metrics, according to Rescana.
How a Race Condition in assign_headers() Works
Apache classes the flaw as concurrent use of a shared resource without proper synchronization. The faulty function is assign_headers().
CyberSecurityNews explained it this way: two parts of the code can touch the same piece of memory at the same time, damaging the heap, the memory a program uses while it runs. That corruption can then lead to code execution.
Red Hat says an attacker who can reach the server needs no authentication and could take full control of the server process.
Only Servers With HTTP/2 Enabled Are Exposed
Red Hat says only servers with HTTP/2 enabled are affected. Apache turns HTTP/2 on through the Protocols directive, using h2 for HTTP/2 over TLS and h2c for plain TCP. It can be set server-wide or per virtual host, so The Hacker News advises checking both.
Wiz’s data shows 64% of cloud environments contain vulnerable resources and 51% have publicly exposed instances. Wiz says those figures do not account for configuration.
Distributions ship their own version numbers, so 2.4.71 will not appear everywhere. Status as of The Hacker News’s November 12 report:
| Platform | Status |
|---|---|
| Apache project releases | Fixed in 2.4.71 |
| Red Hat Enterprise Linux 9 | Fixed, mod_http2-2.0.26-7.el9_9.1 |
| Red Hat Enterprise Linux 10 | Fixed, mod_http2-2.0.29-5.el10_3.1 |
| Red Hat Enterprise Linux 8 and earlier | Not affected |
| Debian unstable | Fixed, apache2 2.4.71-1 |
| Debian bookworm, trixie, forky | Vulnerable |
| Amazon Linux 2, 2023 | Pending fix |
Red Hat rates the flaw Important, not Critical, on RHEL 9 and 10. Its packages give each HTTP/2 stream its own memory allocator, which makes an attack much harder, and RHEL 8 and earlier lack the vulnerable code. Ubuntu’s tracker had no page for the flaw when The Hacker News checked.
Upgrade, or Fall Back to HTTP/1.1
Apache lists no workaround. Its remediation is upgrading to 2.4.71, which the announcement calls “recommended over all previous releases.”
Wiz advises admins who cannot update to remove h2 and h2c from the Protocols directive, leaving “Protocols http/1.1”. CyberSecurityNews says to test that change first because it can affect performance and clients.
Researchers Report Flaw Before November Fix
Anthropic’s OSS Scanner reported the flaw on October 26, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported it on November 3, according to BigGo Finance. The fix was committed and released on November 11. The Hacker News describes the scanner as a free service for open-source projects that uses Anthropic’s AI models.
Administrators who patched an earlier HTTP/2 flaw, CVE-2026-23918, are not necessarily protected: versions 2.4.55 through 2.4.70, including 2.4.67 through 2.4.70, remain affected by this one.
The standalone mod_h2 module from GitHub is affected in versions 2.0.8 through 2.0.42. Its releases end at 2.0.42, and the repository has been read-only since it was archived on June 9, The Hacker News reports. Those servers can use the Protocols change as their stopgap.