Apache HTTP Server CVE-2026-119618: Critical mod_http2 Race Can Lead to Remote Code Execution, Fixed in 2.4.71

The Apache Software Foundation has fixed a critical flaw in the HTTP/2 module of its web server that "can lead to RCE". CVE-2026-119618 affects Apache HTTP Server 2.4.55 through 2.4.70 and is fixed in 2.4.71, released on 11 November. Red Hat scores it CVSS 9.8: reachable over the network, with no login and no user action.

Only servers speaking HTTP/2

Red Hat says "servers configured to serve only HTTP/1.1 are not vulnerable". The bug is a race between threads sharing data without proper locking, in the assign_headers() function of mod_http2, and Apache's advisory says it ends in heap corruption. The one-line fix changes which header table the module writes to when it adds a zero Content-Length to a request whose stream has already ended.

The standalone mod_h2 module from GitHub is hit as well, in releases 2.0.8 through 2.0.42, and that repository was archived in June, so anyone running it should move to the module bundled with httpd 2.4.71.

Exploit status

Cloud security firm Wiz said on 11 November there were "no reports of exploitation in the wild" and that no exploit was available. Red Hat's page contradicts the second part, stating that "public research has demonstrated a reliable exploit against a default-configured server" with mod_http2 enabled, without naming the research. A proof-of-concept on GitHub shows crashes from heap corruption on 2.4.70, not code execution.

Apache credits two finders, Anthropic's OSS Scanner, which reported it on 26 October, and Google Cloud Vulnerability Research, whose report followed on 3 November.

Fixed versions and stopgap

Upgrade to httpd 2.4.71, and Debian ships it for trixie as 2.4.71-1~deb13u1. Red Hat rates RHEL 9 and 10 lower than its other products because they allocate each HTTP/2 stream from a separate allocator, which makes the bug harder to exploit, and RHEL 8 and earlier are not affected.

Where the upgrade has to wait, Wiz's suggestion is to temporarily disable HTTP/2 support by setting Protocols http/1.1 and removing h2 and h2c. Apache's advisory lists no workaround of its own.