Critical Apache HTTP/2 Vulnerability Allows Remote Code Execution

A critical vulnerability in Apache HTTP Server's HTTP/2 module can allow remote code execution, according to security researchers and the Apache HTTP Server Project.

The Vulnerability

CVE-2026-119618 is a race condition in the assign_headers() function of Apache HTTP Server's mod_http2 module. The flaw involves improper synchronization when concurrent threads share resources, which can lead to heap corruption and arbitrary code execution.

Apache credits the discovery to "Anthropic's OSS Scanner, as vulnerability ANT-2026-MAPKT6MZ" and "Anthony Weems and Simon Scannell of the Google Cloud Vulnerability Research." Reports were made on October 26, 2026 and November 3, 2026.

Affected Versions and Fix

Apache states the issue affects Apache HTTP Server from 2.4.55 through 2.4.70. The fix is Apache HTTP Server 2.4.71, released on November 11, 2026. Apache's download page lists 2.4.71 as the latest available version, and its announcement calls it "recommended over all previous releases."

The standalone mod_h2 module from GitHub is affected from version 2.0.8 through 2.0.42. Rescana reports that no fixed mod_h2 release is named yet, and the newest release at the time of checking was still v2.0.42.

Exploitation Status

Wiz states that, as of its blog's publication, no exploit is available and there are no reports of exploitation in the wild. Rescana notes that Apache's advisory does not discuss exploitation, and CVE-2026-119618 was not in CISA's Known Exploited Vulnerabilities catalog as of November 11, 2026 at 20:04 Asia/Jerusalem UTC+2.

Recommended Action

Apache's remediation is to upgrade to Apache HTTP Server 2.4.71 from the official download page. Wiz advises that if immediate patching is not possible, teams can temporarily disable HTTP/2 support by restricting active protocols to HTTP/1.1 in the configuration file, such as httpd.conf, by removing h2 and h2c references.

Wiz data indicates 64% of cloud environments have resources vulnerable to CVE-2026-119618, and 51% of cloud environments have publicly exposed instances. Wiz notes this does not take configuration into account.

Why it matters

A successful exploit could allow an attacker to execute arbitrary commands with the privileges of the web server process. In cloud environments, a compromised Apache instance could serve as an entry point for lateral movement, potentially exposing adjacent microservices or cloud metadata endpoints.

---

Sources

• wiz.io: Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know | Wiz Blog
• rescana.com: Apache HTTP Server 2.4.71 Fixes Critical mod_http2 Heap Corruption (CVE-2026-119618) — Patch Now – Rescana

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.