🔍 Read the full analysis: Apache HTTP/2 Vulnerability: Find Out If CVE-2026-119618 Applies on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Apache released HTTP Server 2.4.71 on November 11 to fix CVE-2026-119618, a critical flaw in mod_http2 that Apache says can lead to remote code execution. The issue affects specified Apache and standalone mod_h2 versions when HTTP/2 is enabled; administrators should check vendor advisories and install available fixes. Reports of exploitation remain unconfirmed, though Red Hat says public research has demonstrated a reliable exploit.
Apache released HTTP Server 2.4.71 on November 11 to fix CVE-2026-119618, a critical vulnerability in mod_http2 that the project says can lead to remote code execution. Administrators should check whether their installed version and configuration are affected: the flaw applies to specified releases with HTTP/2 enabled, and several Linux distribution packages had not yet received fixes as of November 12.
Apache lists HTTP Server versions 2.4.55 through 2.4.70 as affected, along with standalone mod_h2 releases 2.0.8 through 2.0.42 from GitHub. The fixed upstream release is Apache HTTP Server 2.4.71. The vulnerable component is mod_http2, which handles parallel requests sent over an HTTP/2 connection.
Apache describes the flaw as improper synchronization in the assign_headers() function, which can cause heap corruption and lead to remote code execution. Red Hat says a thread-safety problem can allow one thread to modify memory belonging to another. It assesses the vulnerability at CVSS 3.1 score 9.8 out of 10; the National Vulnerability Database had not published its own score as of the source report’s November 12 check.
The configuration matters: Red Hat says servers with HTTP/2 enabled through the Protocols directive using h2 or h2c are affected, while servers serving only HTTP/1.1 are not. Administrators should check their actual settings rather than assume exposure based on a default. Apache’s documentation says the default Protocols setting is http/1.1, with HTTP/2 enabled through configuration.
Vendor status was uneven on November 12. Red Hat said it had shipped fixed packages on November 11, including updates for RHEL 9 and 10; it listed RHEL 8 and earlier as not affected. Red Hat classified the issue as Critical overall but Important for RHEL 9 and 10, citing how those systems allocate HTTP/2 streams. Red Hat JBoss Core Services and Red Hat Hardened Images were still listed as affected. Debian listed bookworm and trixie as vulnerable, with fixed package 2.4.71-1 available only in unstable, sid. The source report found no published Ubuntu or SUSE advisory at that time.
Apache HTTP/2 vulnerability Check whether CVE-2026-119618 applies
Apache released a fix for a critical flaw in mod_http2 that can lead to remote code execution. Exposure depends on both the installed version and whether HTTP/2 is enabled.
Check version and configuration
Apache lists these upstream releases as affected; vendor package guidance may differ.
Apache HTTP Server
Versions 2.4.55 through 2.4.70 are listed as affected. Version 2.4.71 contains the upstream fix.
Standalone mod_h2
GitHub releases 2.0.8 through 2.0.42 are listed as affected.
HTTP/2 enabled
Red Hat says servers using h2 or h2c through the Protocols directive are affected. Servers serving only HTTP/1.1 are not.
What the flaw can do
The issue is in mod_http2 handling of parallel requests over an HTTP/2 connection.
A flaw in assign_headers() can let one thread modify memory belonging to another.
Apache says the memory corruption can lead to remote code execution.
Confirm the installed package and protocol settings, then follow the matching vendor advisory.
Vendor status on November 12
Distribution fixes and advisories were arriving on different schedules.
| Vendor or product | Status reported |
|---|---|
| Red Hat | Fixed packages shipped November 11; RHEL 8 and earlier listed as not affected. |
| Debian | Bookworm and trixie listed as vulnerable; fixed package available in unstable, sid. |
| Ubuntu and SUSE | No published advisory found in the source report at that time. |
| Red Hat JBoss Core Services and Hardened Images | Still listed as affected. |
Exploit reports need context
Red Hat says public research demonstrated a reliable exploit, while reports of real-world exploitation remain unconfirmed.
- Wiz reported no attacks in the wild as of November 11.
- The CVE was not listed in CISA’s catalog when checked November 12.
- Red Hat says public research demonstrated a reliable exploit.
- The cited material does not confirm active exploitation.
- The source report found no public exploit code linked from advisories.
- Wiz’s cloud figures do not measure exploitable servers.
Actions for administrators
Use package-specific vendor guidance because distributions may backport fixes or update advisories later.
- Identify the Apache or standalone mod_h2 version in use.
- Check whether HTTP/2 is enabled through h2 or h2c.
- Apply an available vendor fix and verify that it is installed.
- Monitor vendor notices where a package fix is not yet published.
Patch Exposure on HTTP/2 Servers
The flaw matters because it may let a remote attacker who can reach an affected server run commands without authentication, according to Red Hat. That makes identifying both the installed package and the server’s protocol configuration important. A version number alone may not settle exposure where distributions backport fixes or apply their own package status; administrators should follow the advisory for the operating system or vendor package they actually use.
Cloud exposure figures cited by Wiz require care. The security company said 64% of cloud environments in its data had resources it considered vulnerable and 51% had publicly exposed instances. Wiz also said its figures did not account for configuration, so they are not a measure of the number of exploitable servers. They describe Wiz’s customer data, not all cloud systems.
The gap between a patch release and possible attacks can be short, but the available reports do not establish that attackers are exploiting this flaw now. Red Hat’s statement about a reliable exploit in public research raises the urgency of patching; it does not, by itself, confirm active attacks in the wild.
Products Worth Considering
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Twilight Blue
Jackery Explorer 300 Portable Power Station with 40W Solar Panel, 292Wh
Samsung Odyssey G9 QD-OLED 49 Dual QHD Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Reports and the November 11 Fix
Apache credited Anthropic’s OSS Scanner and two researchers from Google Cloud Vulnerability Research with finding the vulnerability. According to Apache, Anthropic’s report reached the security team on October 26, followed by the Google Cloud researchers’ report on November 3. The CVE number was reserved on October 30, according to the CVE record.
Apache released the fix as version 2.4.71 on November 11. The advisory was posted to the oss-security mailing list that day, and Red Hat also published package information. The discovery timeline is relevant to defenders because the upstream patch is available, while distribution updates and advisory details may arrive on different schedules.
HTTP/2 allows multiple requests to be handled over a single connection. The flaw is in Apache’s handling of that concurrent work, rather than in every HTTP/2 implementation. Apache’s advisory identifies the affected module and function; the source report says Apache did not publish detailed exploit instructions.
“A Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server’s mod_http2 in assign_headers() can lead to RCE.”
— Apache HTTP Server project
Exploit Activity and Vendor Status
Active exploitation has not been confirmed in the cited material. Wiz said on November 11 it had seen no reports of attacks in the wild. The CVE was not listed in CISA’s Known Exploited Vulnerabilities catalog when checked on November 12, although the catalog version cited predated the vulnerability’s public disclosure and therefore does not settle the question.
Red Hat’s claim that public research demonstrated a reliable exploit leaves open what was tested, by whom, and whether the research has been published. The source report found no public exploit code linked from the advisories. It is also not clear from the available information when Ubuntu and SUSE will publish advisories or when Debian stable will receive fixed packages. Vendor status can change after the November 12 check.
Wiz’s cloud percentages do not establish how many affected systems have HTTP/2 enabled or are otherwise exploitable. Nor do the available details establish that every listed version is exposed under every configuration. Administrators should use their vendor’s CVE guidance for package-specific applicability.
Check Configurations and Vendor Updates
Administrators should first identify whether they run an affected Apache HTTP Server or standalone mod_h2 release, then check whether HTTP/2 is enabled through h2 or h2c. Where a fixed package is available, apply it according to the relevant vendor advisory and verify that the update is installed. For systems without a published package update, monitor the distribution’s security notices rather than assuming upstream release availability means the distribution has shipped the fix.
Further developments to watch include updated advisories from Debian, Ubuntu and SUSE; additional vendor guidance for affected Red Hat products; and any evidence clarifying the public exploit research or real-world attack activity. The status described here reflects information available on November 12, 2026, and may change as vendors issue updates.
Key Questions
Which Apache versions are affected by CVE-2026-119618?
Apache lists HTTP Server 2.4.55 through 2.4.70 and standalone mod_h2 versions 2.0.8 through 2.0.42 as affected. Apache HTTP Server 2.4.71 contains the upstream fix.
Does the vulnerability affect servers that use only HTTP/1.1?
Red Hat says servers serving only HTTP/1.1 are not affected. The issue concerns mod_http2 and applies to servers with HTTP/2 enabled, including through the h2 or h2c Protocols setting.
Are attackers exploiting the flaw?
The cited sources do not confirm attacks in the wild. Wiz reported no known exploitation as of November 11, while Red Hat said public research had demonstrated a reliable exploit. Those statements concern different things: exploit research does not establish that attackers are using it.
What should administrators do?
Check the installed Apache package, the server’s HTTP/2 configuration and the relevant operating-system advisory. Install the vendor’s fixed package when available; upstream Apache’s fixed release is 2.4.71.
Why might my Linux distribution show a different status from Apache?
Linux vendors package and maintain Apache separately and may backport fixes or publish updates on their own schedules. Check the advisory for the specific distribution and package rather than relying only on the upstream version range.
Source: ThorstenMeyerAI.com
