Apache patches critical mod_http2 RCE in HTTP Server 2.4.71

Apache HTTP Server 2.4.71 fixes CVE-2026-119618, a critical race condition in mod_http2 that can lead to unauthenticated remote code execution. Fix released November 11. Exploitation in the wild: none reported as of November 12, per Wiz.

What is affected

Confirmed by SecurityWeek and The Hacker News:

• Apache HTTP Server 2.4.55 through 2.4.70.
• Standalone mod_h2 2.0.8 through 2.0.42, per BleepingComputer.
• Only servers with HTTP/2 enabled. HTTP/1.1-only servers are not vulnerable. HTTP/2 is off by default.

The flaw is improper synchronization on shared resources in assign_headers(). Concurrent threads can corrupt heap memory. Code would run with the privileges of the web server process.

Severity and exploitation status

Red Hat rates the flaw 9.8 on CVSS and says public research has demonstrated a reliable exploit. It does not identify that research. Confirmed: Red Hat’s statement. Unconfirmed: the existence of a working public exploit.

Wiz reported no available exploit and no in-the-wild activity when it published on November 11. SecurityWeek reports a GitHub proof of concept that shows memory corruption and process crashes, not code execution.

Red Hat rates it Important, not Critical, on RHEL 9 and 10. Its packages give each HTTP/2 stream its own memory allocator, which makes an attack harder. RHEL 8 and earlier do not contain the vulnerable code.

Exposure

Wiz telemetry: 64% of cloud environments hold affected resources, and 51% of those environments have publicly exposed instances. Wiz notes these figures ignore configuration, so they overstate exploitable hosts.

Discovery

Apache credited Anthropic’s OSS Scanner, which reported the flaw on October 26. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research independently reported it on November 3.

Patch status

• Apache project releases: fixed in 2.4.71.
• RHEL 9 and 10: fixed packages shipped November 11.
• Debian unstable: fixed in 2.4.71-1. Debian bookworm, trixie and forky: vulnerable, no fix listed, per The Hacker News.
• Amazon Linux: fix pending. Ubuntu: no tracker page at time of reporting.
• mod_h2 standalone: no fixed release. Its repository has been archived since June 9.

Mitigation

The Apache advisory offers no workaround. Wiz advises removing h2 and h2c from the Protocols directive, leaving http/1.1. The directive can be set per virtual host, so every virtual host needs checking. watchTowr’s advice: patch now or drop h2 until you can.

WordPress security updates do not address this. It sits in the web server layer, per Defiant, as reported by SecurityWeek.

2.4.71 also fixes a crash in mod_md and a low-severity memory flaw in mod_vhost_alias.

Analysis: the standalone mod_h2 gap is the long tail. Archived code with a critical flaw and no fix leaves only the configuration change.