Back

Apache Fixes Critical HTTP/2 Remote Code Execution Flaw

lite News Desk 1 min read

Apache HTTP Server 2.4.71, released on November 11, 2026, fixes CVE-2026-119618, according to the Apache HTTP Server Project. Apache classifies the mod_http2 vulnerability as critical and identifies versions 2.4.55 through 2.4.70 as affected.

Red Hat said the vulnerability can allow an attacker to run commands remotely without authentication, provided the server has HTTP/2 enabled. Its assessment excludes servers configured to use HTTP/1.1 alone.

Apache's advisory locates the problem in the assign_headers() handling within mod_http2. According to Apache, access to a shared resource by concurrent operations without adequate synchronization can corrupt heap memory and allow remote code execution.

Red Hat's explanation describes how mod_http2 uses multiple threads to process HTTP/2 requests concurrently. With this vulnerability, a thread can change memory that another thread is using, resulting in corruption of the server's memory. Red Hat said the severity can differ across its products because they use different memory-allocation arrangements.

The Apache advisory also records reports from two sources. It assigns an October 26, 2026, report date to Anthropic's OSS Scanner. For Google Cloud Vulnerability Research's Anthony Weems and Simon Scannell, the advisory records a report dated November 3, 2026.

* This article is based on publicly available information at the time of writing.

More from Cybersecurity

  1. Onapsis reported no observed in-the-wild exploitation as of November 10, 2026.

  2. The flaw affects Linux systems using musl without PAM under specific password-authentication and account conditions.

  3. Exploitation requires a user to open a specially prepared message file; Outlook may then contact an attacker-controlled network destination without its usual warning.

  4. N-able advised customers running N-central on their own premises to disconnect their servers until further instructions.

  5. D-Link’s interim advice is to disable DDP on the switch and applicable interfaces; the company said this stopped tested DDP attack paths.