Hermes Vector

Tech

Race condition in Apache HTTP Server HTTP/2 module allows remote code execution

CVE-2026-119618 affects Apache HTTP Server versions 2.4.55 through 2.4.70 and can lead to arbitrary code execution. Apache has released version 2.4.71 to fix the issue.

By Hermes Vector

Also in: Español · Português · Français · Deutsch · हिन्दी · 中文

Checked against 2 sourcesgbhackers.comnews.lavx.hu
Illustration for: Race condition in Apache HTTP Server HTTP/2 module allows remote code execution

In brief

  • CVE-2026-119618 is a race condition in the Apache HTTP Server HTTP/2 module that can lead to arbitrary code execution.
  • The vulnerability affects Apache HTTP Server versions 2.4.55 through 2.4.70 and mod_h2 module versions 2.0.8 through 2.0.42.
  • Apache has released version 2.4.71 to fix the issue; standalone mod_h2 builds should be upgraded to a version newer than 2.0.42.
  • No public exploit exists and no reports show exploitation in the wild.

Race condition in Apache HTTP Server HTTP/2 module allows remote code execution

A race condition in the Apache HTTP Server HTTP/2 module gives a remote, unauthenticated attacker a path to run code on affected servers. The vulnerability, tracked as CVE-2026-119618, affects the mod_http2 module in versions 2.4.55 through 2.4.70.

According to LavX News, the flaw lets a remote, unauthenticated attacker corrupt heap memory in Apache HTTP Server through a flaw in the HTTP/2 module. That corruption can lead to arbitrary code execution with the privileges of the web server process.

No public exploit exists, and no reports show exploitation in the wild.

Affected and patched versions

ProductAffected versionsPatched versions
Apache HTTP Server2.4.55 through 2.4.702.4.71 and newer
mod_h2 module (GitHub)2.0.8 through 2.0.42Versions newer than 2.0.42

Exposure in cloud environments

A compromised Apache instance can give an attacker a foothold inside containerized or virtualized workloads. From there, the attacker can move to adjacent microservices or reach cloud metadata endpoints.

Research data shows the scale of exposure: 64% of cloud environments contain resources vulnerable to CVE-2026-119618, and 51% of cloud environments run publicly exposed instances. These figures do not account for configuration details.

Steps for security teams

Upgrade deployments. Update Apache HTTP Server installations to version 2.4.71 or later. Teams that manage standalone mod_h2 builds from GitHub should upgrade the module to a version newer than 2.0.42.

Disable HTTP/2 as a temporary measure. If teams cannot apply the patch, they can remove the attack vector by restricting servers to HTTP/1.1. Edit the configuration file (such as httpd.conf) to remove h2 and h2c references:

Restrict protocols to HTTP/1.1

Protocols http/1.1

After making this change, restart the server and confirm that clients fall back to HTTP/1.1. Teams should treat this step as a stopgap and schedule the upgrade to a patched release.

Source: Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know | Wiz Blog, by Merav Bar, wiz.io, Nov 11, 2026

Sources

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.

Questions readers ask

What is the vulnerability in Apache HTTP Server?
A race condition in the mod_http2 module allows remote, unauthenticated attackers to corrupt heap memory and execute arbitrary code with the privileges of the web server process. This flaw is tracked as CVE-2026-119618.
Which versions of Apache HTTP Server are affected?
Apache HTTP Server versions 2.4.55 through 2.4.70 are affected, while versions 2.4.71 and newer are patched. The mod_h2 module from GitHub is affected in versions 2.0.8 through 2.0.42, with versions newer than 2.0.42 being patched.
How many cloud environments are vulnerable to this CVE?
Research data shows that 64% of cloud environments contain resources vulnerable to CVE-2026-119618, and 51% of cloud environments run publicly exposed instances.
What is the temporary workaround if a patch cannot be applied immediately?
Teams can restrict servers to HTTP/1.1 by editing the configuration file to remove h2 and h2c references and restarting the server. This step should be treated as a stopgap measure until an upgrade to a patched release is scheduled.

The day's checked news, by email

One short email a day with the top stories. Free, and you can unsubscribe in one click.

Or follow for the latest news:

How do you feel about this story?

Comments 0

No comments yet. Start the discussion.

More Tech stories

Tech

Apple to Shut Down Support Community on November 20

Apple is permanently closing its Apple Support Community discussion forums on November 20, 2026. The site is now read-only and will no longer accept new posts.

Checked against 6 sourcesengadget.commacrumors.compcmag.com+3 more

Tech

Google patches eighth exploited Chrome zero-day of 2026

Google has released Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux to fix CVE-2026-125350, a high-severity use-after-free flaw in the XML component that attackers are exploiting in the wild.

Checked against 6 sourcesbleepingcomputer.comsecurityweek.comsecurityaffairs.com+3 more