Apache HTTP Server 2.4.71 patches a critical RCE flaw in mod

Why it mattersAny site running Apache with HTTP/2 enabled is reachable to an unauthenticated attacker. The fix is one version jump, and the audit says 64 percent of cloud environments have a vulnerable instance.

A site running Apache with HTTP/2 enabled is reachable to an unauthenticated attacker. Apache released HTTP Server 2.4.71 on 11 November. The release fixes CVE-2026-119618, a critical flaw in the mod_http2 module. The advisory on httpd.apache.org says a race condition in the assign_headers() function leads to remote code execution.

Two security teams found the bug separately. Anthropic's open-source scanner reported it on 26 October. Google Cloud's vulnerability research team reported it on 3 November. Apache committed the fix on 11 November. Apache released the new version the same day.

What is affected

The advisory names Apache HTTP Server 2.4.55 through 2.4.70 as vulnerable. The standalone mod_h2 module on GitHub is vulnerable from 2.0.8 through 2.0.42. The patched version is Apache HTTP Server 2.4.71. The fix commit is 824beab9b9424d6cfb29595248fdbf6c3dddeab1.

Apache's own classification is critical. The flaw does not need credentials to exploit. An attacker reaches it by sending crafted HTTP/2 traffic to the server.

How many servers run vulnerable code

A report from the cloud security firm Wiz says 64 percent of cloud environments have a vulnerable Apache instance. The same report says 51 percent of them have one exposed to the public internet. Those are Wiz's numbers. The company reached them from its own scan of customer environments.

Wiz also says there is no public exploit yet. The company had not seen the flaw used in the wild as of its post on 11 November. Apache itself does not comment on exploitation.

What to do

Upgrade to Apache HTTP Server 2.4.71. The advisory names every point release from 2.4.55 forward as vulnerable. Checking is the version string, not a feature flag. A server that removes mod_http2 from the loaded modules turns HTTP/2 off. That server is not reachable to this flaw.

A team that cannot upgrade right away can turn HTTP/2 off as a stop-gap. The site then serves only HTTP/1.1. That changes performance for clients using HTTP/2. The server stays reachable. The patch itself is small. A production team should still read the Apache changelog before upgrading. A point release can change timeout behaviour and worker memory in ways a traffic graph will notice.

The advisory credits two teams. One is Anthropic's OSS Scanner. Apache tracks the report under the identifier ANT-2026-MAPKT6MZ. The other is Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research. Each team found the same bug on its own. That is why the advisory names both.

Source

Apache HTTP Server 2.4 security advisory, CVE-2026-119618. Secondary coverage from Wiz, "Critical RCE Vulnerability in Apache HTTP Server".

This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.