Apache HTTP Server 2.4.71 Fixes Critical mod_http2 RCE CVE-2026-119618

Title: Apache 2.4.71 Patches Critical Race-Condition RCE in mod_http2

Summary: The Apache HTTP Server project shipped 2.4.71 on November 11, 2026, closing CVE-2026-119618, its only critical in this release: a concurrent-execution flaw with improper synchronization in the HTTP/2 module’s assign_headers() function that lets a remote, unauthenticated attacker trigger heap corruption and achieve remote code execution with the privileges of the web server process. Only servers with HTTP/2 enabled are exposed — the flaw lives in mod_http2 itself, so it reaches any virtual host or server scope where the Protocols directive turns on h2 (HTTP/2 over TLS) or h2c (cleartext). Affected versions run from 2.4.55 through 2.4.70, and standalone GitHub builds of mod_h2 are affected from 2.0.8 through 2.0.42; that project’s repository has been archived and read-only since June 9, so it has published no fixed release — the Protocols change is the only mitigation there. The issue was reported by Anthropic’s OSS Scanner on October 26 and independently by Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research on November 3, per the Apache advisory. On public exploitability the sources disagree: per The Hacker News, Red Hat’s assessment, published November 11, says public research has demonstrated a reliable exploit against a server in its default configuration with mod_http2 enabled, while Wiz’s analysis, published the same day 2.4.71 landed, reported no exploit available and no exploitation in the wild as of its writing — and puts the exposure in context: 64% of cloud environments hold resources vulnerable to this CVE. Wiz advises teams that cannot patch yet to drop h2 and h2c from Protocols, leaving Protocols http/1.1. 2.4.71 also fixes an important mod_md NULL-pointer dereference (CVE-2026-106023, affects 2.4.30–2.4.70) and a low-rated one-byte stack overwrite in mod_vhost_alias (CVE-2026-109163, affects 2.4.69–2.4.70). Distribution coverage is moving quickly: Debian listed DSA-6620-1 for apache2 on November 12, and per The Hacker News, Red Hat shipped fixed mod_http2 packages for RHEL 9 and 10 on November 11 (rating the flaw Important rather than Critical there, since RHEL’s mod_http2 builds give each HTTP/2 stream its own allocator), while RHEL 8 and earlier do not contain the vulnerable code.

References:

The desk behind the headlines