🔍 Read the full analysis: Are You Affected By Critical Apache HTTP/2 Flaw CVE-2026-119618? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Apache released HTTP Server 2.4.71 on November 11 to fix CVE-2026-119618, a critical flaw in mod_http2 that Apache says can lead to remote code execution. The issue affects HTTP Server 2.4.55–2.4.70 and certain standalone mod_h2 releases; exposure depends on HTTP/2 being enabled. Public exploitation has not been confirmed, but Red Hat says public research has demonstrated a reliable exploit.
Apache released HTTP Server 2.4.71 on November 11 to fix CVE-2026-119618, a critical flaw in its mod_http2 module that the project says can lead to remote code execution. The issue affects Apache HTTP Server 2.4.55 through 2.4.70 and specified versions of the standalone mod_h2 module; servers are exposed only when HTTP/2 is enabled, according to Red Hat.
Apache describes the defect as a thread-synchronization vulnerability in the mod_http2 function assign_headers(), with the title “heap corruption and RCE in assign_headers.” The bug is in code that processes HTTP/2 requests, which can be handled concurrently over a connection. Apache’s advisory says the flaw “can lead to RCE”; Red Hat explains that one thread may modify memory used by another, corrupting server memory.
Red Hat says an unauthenticated remote attacker who can reach an affected web server could exploit the flaw to execute commands. It assigns the issue a CVSS 3.1 score of 9.8 out of 10. That is Red Hat’s rating; the source material says the National Vulnerability Database had not published its own score as of November 12. Apache’s affected range is 2.4.55–2.4.70; the standalone mod_h2 project lists versions 2.0.8–2.0.42 as affected. The upstream fix is 2.4.71.
Red Hat shipped fixed packages on November 11, including updates for Enterprise Linux 9 and 10. Red Hat says Enterprise Linux 8 and earlier are not affected, while its JBoss Core Services and Hardened Images were still listed as affected. Debian’s stable bookworm and trixie branches were listed as vulnerable in the source report; version 2.4.71-1 had reached Debian unstable (sid). The report found no published Ubuntu or SUSE advisory at the time it checked, which does not establish whether those distributions are affected.
Critical HTTP/2 flaw What administrators need to know
Apache HTTP Server 2.4.71 fixes CVE-2026-119618, a critical flaw in mod_http2 that can lead to remote code execution. Exposure depends on the affected software and HTTP/2 being enabled.
Check whether your server is exposed
A vulnerable, reachable server may be at risk when HTTP/2 is enabled through h2 or h2c.
Check the Apache version and your operating system vendor’s package status.
Check whether the service enables h2 or h2c; servers serving only HTTP/1.1 are not affected, according to Red Hat.
Update to Apache 2.4.71 or the patched package supplied for your distribution.
Vendor status varies
The November 12 report is a snapshot; package status may change.
| System or package | Reported status |
|---|---|
| Red Hat Enterprise Linux 9 and 10 | Fixed packages released November 11 |
| Red Hat Enterprise Linux 8 and earlier | Not affected, according to Red Hat |
| Red Hat JBoss Core Services and Hardened Images | Listed as affected |
| Debian bookworm and trixie | Listed as vulnerable; 2.4.71-1 reached unstable |
| Ubuntu and SUSE | No advisory found in the report’s check |
What the exposure figures mean
Wiz’s measurements describe its customer environments, not all servers worldwide.
- 64% had resources Wiz considered vulnerable.
- 51% had publicly exposed instances.
- They do not account for configuration.
- They do not show how many servers can actually be exploited.
Exploit reports remain unsettled
The available accounts distinguish demonstrated exploit research from confirmed attacks.
Patch HTTP/2 Servers Without Delay
The flaw matters because a vulnerable, reachable server with HTTP/2 enabled may be at risk of remote command execution, which could give an attacker control beyond ordinary web requests. Administrators should identify the Apache version actually installed, check the server’s protocol configuration and apply the update supplied by their operating-system vendor. A version number alone may not tell the full story when a distribution backports fixes into its packages.
Wiz reported that 64% of cloud environments in its customer data had resources it considered vulnerable and 51% had publicly exposed instances. Those figures are Wiz’s observations, not a global server count, and the company said they did not account for configuration. They should not be read as the share of servers that can actually be exploited. The relevant exposure depends on affected software, HTTP/2 configuration and vendor-specific package status.
The public exploitation picture is unresolved. Wiz said it had seen no reports of exploitation in the wild when it published its account. Red Hat, however, said public research had demonstrated a reliable exploit against a default-configured server with mod_http2 enabled. That statement does not establish that attacks are occurring, but it makes waiting for proof of widespread exploitation a poor basis for patch timing.
Products Worth Considering
Samsung Galaxy Tab A11 8.7-Inch Wi-Fi Tablet, 64GB, 4GB RAM, 90Hz, Gray, with 20W Charger
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Samsung Odyssey G3 G30D 27-Inch FHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Fix and Reports Unfolded
Apache credited Anthropic’s OSS Scanner and two researchers from Google Cloud Vulnerability Research with finding the issue. Apache’s timeline says Anthropic reported it on October 26 and the Google Cloud researchers reported it on November 3. The CVE number was reserved on October 30, and Apache published the fix in version 2.4.71 on November 11. The sequence places the first report 16 days before the release.
HTTP/2 allows a client to make multiple requests over one connection. Apache’s mod_http2 handles that work across threads, and the reported defect involves concurrent access to shared memory. Red Hat says the relevant configuration is HTTP/2 enabled through the Protocols directive, using h2 or h2c. It says servers serving only HTTP/1.1 are not affected. Apache documentation, as cited in the source report, gives “Protocols http/1.1” as the default; administrators should verify their own configuration rather than assume the default applies.
Distribution status can differ from upstream status because many systems receive Apache through their Linux vendor. Red Hat rated the issue critical overall but important for Enterprise Linux 9 and 10, citing allocator differences that it said increase exploitation complexity. Its fixed packages included RHSA-2026:98981 for RHEL 9 and RHSA-2026:98978 for RHEL 10. Debian’s status was different: its stable releases were still marked vulnerable in the report, while the fix was in unstable. These details are a snapshot from November 12, 2026, not a guarantee of current repository status.
““Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server’s mod_http2 in assign_headers() can lead to RCE.””
— Apache HTTP Server project
Exploit Activity and Vendor Status
Active attacks have not been confirmed in the material available on November 12. Wiz reported no known in-the-wild exploitation, and the CVE was not on the CISA Known Exploited Vulnerabilities catalog when checked. The cited catalog version, however, was released before the CVE became public, so its omission is not evidence that exploitation is absent.
Red Hat’s reference to a reliable exploit is not accompanied in the source material by the identity of the researchers, a publication link or details about whether the work is available publicly. Apache did not publish exploit details, and the report found no public exploit code linked from the advisories. The exact exploitability across configurations and vendor builds remains uncertain.
Package status is also time-sensitive. The information about Debian, Red Hat, Ubuntu and SUSE reflects checks made on November 12, 2026. The source report found no published Ubuntu or SUSE advisory at that point; readers should check their distribution’s current security notices rather than infer that an unlisted system is safe. Wiz’s percentages describe its customer environments and do not measure the number of exploitable servers worldwide.
Verify Configuration and Apply Vendor Fixes
Administrators should first determine whether their server runs an affected upstream version or a distribution package that has not yet received a fix. They should check whether HTTP/2 is enabled for the service, including h2 or h2c, then install Apache 2.4.71 or the appropriate vendor-provided patched package. Because distribution releases can differ, use the vendor’s advisory and package version information rather than relying only on the upstream version range.
Teams responsible for Red Hat systems can consult the applicable security notice and confirm that the fixed package is installed; Debian users should check for updates to their release branch. Operators on systems without a published advisory in the November 12 snapshot should monitor their vendor’s security notices and seek current confirmation of affected status. Organizations should also review which HTTP services are publicly reachable as part of their patch prioritization.
Further information may change the picture: vendors can publish new package advisories, and researchers or authorities may clarify exploit availability or observed attacks. Until then, the established facts are that Apache has released a fix, the flaw can lead to remote code execution, and exposure depends in part on HTTP/2 configuration. The available reports do not confirm widespread exploitation.
Key Questions
Which Apache versions are affected?
Apache lists HTTP Server versions 2.4.55 through 2.4.70 as affected. The standalone mod_h2 project lists versions 2.0.8 through 2.0.42. Apache HTTP Server 2.4.71 contains the upstream fix.
Are HTTP/1.1-only servers affected?
Red Hat says servers serving only HTTP/1.1 are not affected. The issue concerns mod_http2, and Red Hat identifies HTTP/2 enabled through the Protocols directive as the relevant configuration. Check the server’s actual settings.
Is the flaw being exploited in attacks?
The source material does not confirm attacks in the wild. Wiz said it had no reports of exploitation when it published its account, while Red Hat said public research had demonstrated a reliable exploit. CISA’s catalog omission at the time was not conclusive because the cited catalog version predated public disclosure.
What should administrators do?
Check the installed Apache package and whether HTTP/2 is enabled, then apply Apache 2.4.71 or the fixed package from your operating-system vendor. Confirm status through current vendor advisories, since package availability can change and distributions may backport fixes.
Source: ThorstenMeyerAI.com
