Apache Patches Critical HTTP/2 Flaw Allowing Remote Code Execution
Apache has released version 2.4.71 to fix a critical concurrency vulnerability in its HTTP/2 module (mod_http2) that could allow remote code execution.
Apache has released an update, version 2.4.71, to address a critical vulnerability within its HTTP/2 module, mod_http2. This flaw, tracked as CVE-2026-119618, is a concurrency issue that can lead to remote code execution (RCE) by exploiting a race condition in the assign_headers() function. The vulnerability has the potential to corrupt heap memory, a critical area used by programs during execution, which can be leveraged by attackers to gain control of affected servers.
The severity of this vulnerability is underscored by Apache's own classification of "Critical," a label reserved for flaws that allow remote attackers to execute code on a server, potentially enabling self-propagating attacks similar to worms. While the CVE entry is still marked as reserved, lacking a public CVSS score or detailed technical analysis, security professionals are strongly advised to apply the patch immediately without waiting for further information.
This critical flaw affects Apache HTTP Server versions 2.4.55 through 2.4.70. Additionally, users of the standalone mod_h2 module, available from GitHub, should ensure they are running versions 2.0.8 through 2.0.42 or later. The primary concern lies with servers actively serving HTTP/2 traffic, as the vulnerability is specific to this module.
The vulnerability was initially discovered by Anthropic's OSS Scanner, which reported it to the Apache security team on October 26, 2026. Shortly thereafter, on November 3, Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research independently reported the same issue. The fact that two separate teams identified the flaw within days highlights the intense scrutiny on HTTP/2 code by researchers.
The release of Apache HTTP Server 2.4.71 not only addresses CVE-2026-119618 but also closes two additional vulnerabilities. CVE-2026-106023, rated "important," is a NULL pointer error in mod_md that could crash a child process. CVE-2026-109163, a "low" rated one-byte stack overflow in mod_vhost_alias, affects only the latest versions of the server.
This patch comes shortly after a significant update in October (version 2.4.69) that fixed 20 CVEs, and another in June (2.4.68) that addressed 13. The repeated need for updates, especially for public-facing servers, can be taxing for administrators. However, the critical nature of CVE-2026-119618 necessitates prompt action.
Apache has not provided a specific workaround for this flaw. The most effective mitigation is to upgrade to Apache HTTP Server 2.4.71 as soon as possible, prioritizing public-facing servers that utilize HTTP/2. For those unable to upgrade immediately, temporarily disabling HTTP/2 and reverting to HTTP/1.1 is an option, though this should be tested for potential performance impacts and client compatibility issues. Administrators should also monitor server logs for unusual activity, such as unexpected crashes or worker process restarts, which could indicate exploitation attempts.
It is important to note that many Linux distributions may backport security fixes without incrementing the main version number. Therefore, administrators should consult their specific distribution's security advisories and package changelogs to confirm whether their systems are protected.
This new report details the specific CVE identifier for the Apache HTTP/2 module flaw, CVE-2026-119618, and notes that public research has demonstrated a reliable exploit. It also clarifies that only servers with HTTP/2 enabled are vulnerable and provides a workaround by disabling HTTP/2 protocols if immediate patching is not possible.