Apache Patches Critical HTTP/2 Flaw Allowing Remote Code Execution. Some Linux Distributions Still Lack Fixes

The Apache HTTP Server Project shipped version 2.4.71 on Nov. 11 to close a critical remote code execution hole in its HTTP/2 module. The flaw is tracked as CVE-2026-119618, and Apache rates it critical.

As of today, Nov. 12, the patch is out. A lot of servers are not patched yet.

What the flaw is

Apache's advisory titles it "mod_http2: heap corruption and RCE in assign_headers." It is a race condition, classified as CWE-362: concurrent execution using a shared resource with improper synchronization.

The vulnerable function sits in modules/http2/h2_request.c. It clones a shared header table into a per-request structure, then writes to the shared table again without adequate locking. The session thread and worker threads can touch that table at the same time, which corrupts heap memory.

An attacker needs network access to the server and no login. Red Hat says successful exploitation could hand over full control of the server process.

Only servers that negotiate HTTP/2 are exposed. That means h2 or h2c is enabled in the Protocols directive, either server-wide or in a single virtual host.

Who is affected

Apache HTTP Server 2.4.55 through 2.4.70 are affected. The standalone mod_h2 module, published on GitHub, is affected in versions 2.0.8 through 2.0.42.

Wiz says 64% of the cloud environments it monitors contain resources vulnerable to the flaw, and 51% have publicly exposed instances. Wiz adds that those figures do not account for configuration, so they overstate how many servers actually have HTTP/2 switched on.

Is there a working exploit?

That is disputed.

Red Hat's assessment says "public research has demonstrated a reliable exploit" against a server in its default configuration with mod_http2 enabled. Red Hat does not name or link that research. Red Hat gives the flaw a CVSS score of 9.8 out of 10.

Wiz says the opposite. In its analysis, published the same day, Wiz states that no exploit is available and that no exploitation in the wild has been reported. Apache's advisory does not discuss exploitation. Rescana's check of CISA's Known Exploited Vulnerabilities catalog on Nov. 11 found no entry for the CVE.

Apache has not published a CVSS score, and the National Vulnerability Database entry was still in "Received" status with no metrics as of Nov. 11. The 9.8 figure comes from Red Hat's own scoring.

Who found it

Anthropic's OSS Scanner, a service that scans open-source projects, reported the bug to Apache on Oct. 26. Apache's timeline tracks it as ANT-2026-MAPKT6MZ. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported it independently on Nov. 3.

The fix landed Nov. 11, about two weeks after the first report.

Patch status by platform

Red Hat shipped fixes for Red Hat Enterprise Linux 9 and 10 on Nov. 11. On RHEL 9 the fix ships as mod_http2-2.0.26-7.el9_9.1. Red Hat rates the flaw Important, not Critical, on those releases. Its packages give each HTTP/2 stream its own memory allocator, which Red Hat says makes an attack much harder. RHEL 8 and earlier do not contain the vulnerable code.

Debian's security tracker lists no fix for bookworm, trixie or forky. Amazon Linux's tracker shows fixes pending. Ubuntu's CVE tracker had no page for the flaw when The Hacker News checked it.

Many distributions backport security fixes without changing the upstream version number. Running `apachectl -v` and seeing an old number does not prove a server is exposed. Admins should check the vendor advisory and package changelog. `apachectl -M | grep http2` shows whether the module is loaded.

What admins can do

Apache says to upgrade to 2.4.71. The advisory offers no workaround.

Wiz recommends that admins who cannot update yet remove h2 and h2c from the Protocols directive and set it to `Protocols http/1.1`. That turns off HTTP/2 and removes the attack path. Admins need to check the server-wide setting and every virtual host.

The 2.4.71 release also fixes two lesser bugs. CVE-2026-106023 is a NULL pointer dereference in mod_md, rated important by Apache, that can crash a child process and affects 2.4.30 through 2.4.70. CVE-2026-109163 is a one-byte stack overwrite in mod_vhost_alias, rated low, affecting only 2.4.69 and 2.4.70.

This is the latest in a heavy year for Apache patching. Cybersecurity News counts 20 CVEs fixed in 2.4.69 in October and 13 in 2.4.68 in June. Admins who updated in October now have to do it again.

The abandoned module

The standalone mod_h2 has no fix. Its GitHub release list ends at 2.0.42, the last affected version, and the repository has been read-only since it was archived on June 9. Anyone running those builds has only the configuration change to fall back on.

Whether the archived project gets a patch, or whether users are pushed onto Apache's bundled module, is not settled. Neither Apache nor the mod_h2 repository has announced a fixed standalone release, and Debian and Amazon Linux have not yet published theirs.