Apache HTTP Server 2.4.71 Fixes a Critical HTTP/2 RCE

The version to install is Apache HTTP Server 2.4.71. The Apache Software Foundation released it on 11 November 2026 to fix a critical flaw in the HTTP/2 module, mod_http2. Anyone still on 2.4.55 through 2.4.70 should move to 2.4.71. Where a standalone copy of mod_h2 was built from GitHub, Apache’s advisory says the affected releases run from 2.0.8 through 2.0.42, so that module needs a build newer than 2.0.42. If a patch cannot be applied at once, Wiz sets out a temporary mitigation: disable HTTP/2, including by setting Protocols http/1.1.

The flaw is tracked as CVE-2026-119618. The CVE record was published at 14:54 GMT on 11 November 2026 with the same wording Apache uses: a “Concurrent Execution using Shared Resource with Improper Synchronization” bug in assign_headers() “can lead to RCE.” Apache gives that issue a “critical” rating and does not publish a CVSS score; the CVE record likewise records the severity as critical, with no numeric score. The same 2.4.71 release also fixes two further vulnerabilities, one rated important and one low.

The critical flaw is a race in mod_http2

Apache’s description is short and should be kept at that level. The race sits in assign_headers() inside mod_http2, and the foundation says it can lead to remote code execution. The CVE record titles the issue “mod_http2: heap corruption and RCE in assign_headers.” Nothing in the official advisory or the CVE entry describes exploitation in the wild.

The finders are named on both of those official pages. Anthropic’s OSS Scanner, recorded as vulnerability ANT-2026-MAPKT6MZ, was reported to Apache’s security team on 26 October 2026. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research were reported on 3 November 2026. The 2.4.71 fix is recorded against commit 824beab, with the update released on 11 November. That sequence is of a piece with other recent cases in which a research team has taken flaws in widely used open-source infrastructure through to a patch, including Microsoft’s MDASH work on the Linux kernel and Anthropic’s account of unreleased-model findings that were patched in Chrome.

Wiz’s write-up, published at 19:49 GMT on 11 November 2026, should be read as vendor analysis, not as a second official advisory. At the time of publication, Wiz said “no exploit is available and there are no reports of exploitation in the wild.” It also said that, on its own data, “64% of cloud environments have resources vulnerable to CVE-2026-119618, and 51% of cloud environments have publicly exposed instances,” and that this “does not take configuration into account.” Those shares are Wiz’s. On Wiz’s own caveat, they leave open whether HTTP/2 is actually enabled on a given server. The CVE was not listed in CISA’s Known Exploited Vulnerabilities catalog when that feed was checked on 12 November 2026.

Apache HTTP Server 2.4.71 also closes two lesser flaws

The 11 November release is broader than the critical HTTP/2 bug. Apache says 2.4.71 fixes three CVEs in total: one critical, one important and one low.

The important issue is CVE-2026-106023, a NULL pointer dereference in mod_md during HTTP request processing that can crash a child process. It affects Apache HTTP Server 2.4.30 through 2.4.70. The low issue is CVE-2026-109163, a one-byte stack buffer overwrite in mod_vhost_alias, affecting 2.4.69 and 2.4.70. Both are fixed in 2.4.71. They matter for anyone planning a single maintenance window, but they are not a reason to treat the critical mod_http2 fix as optional.

Wiz’s temporary advice, if 2.4.71 cannot be installed immediately, is to turn HTTP/2 off so the affected code path is not in use. Its example is the Apache directive Protocols http/1.1. That is a workaround, not the fix. The fix is 2.4.71, or a standalone mod_h2 newer than 2.0.42.

A critical rating is not the same as an active attack

The practical conclusion is already in the first paragraph, and it does not depend on a CVSS number Apache has not issued. A critical remote-code-execution rating on the HTTP/2 module of Apache HTTP Server is enough to justify an upgrade to 2.4.71, or, if that upgrade has to wait, to disable HTTP/2. The important and low issues in the same release are a reason to take the whole update, not a reason to delay the critical one.

What the official record does not show is an in-the-wild campaign. Wiz, writing on the day the CVE was published, said no exploit was available and that it had no reports of exploitation. The CVE was also absent from CISA’s known-exploited list the following morning. Those points are worth keeping in their proper place. They describe the public status of the bug as of those checks. They are not evidence that a server can be left on 2.4.70.

Wiz’s 64% and 51% figures need the same care. They are Wiz’s cloud-environment counts, and Wiz itself says they leave configuration out of the account. A host counted as “vulnerable” in that dataset may already have HTTP/2 turned off; a host counted as exposed may not be reachable on the ports that matter. The figures are a reason to inventory Apache HTTP Server estates quickly. They are not, on their own, a measure of how many servers can actually be reached through the flawed path.

The useful distinction is between a serious patch and an active incident. This release belongs in the first category until a later official source says otherwise. The work for operators is still the upgrade to 2.4.71, with HTTP/2 disabled only as a stopgap, and a watch on vendor packages and on CISA’s catalog if the public status changes.

Sources

1. Apache HTTP Server Project, “Apache HTTP Server 2.4 vulnerabilities,” entry for 2.4.71, released 11 November 2026. https://httpd.apache.org/security/vulnerabilities_24.html
2. CVE record, CVE-2026-119618, published 11 November 2026, 14:54 GMT. https://www.cve.org/CVERecord?id=CVE-2026-119618
3. Wiz, “Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know,” 11 November 2026, 19:49 GMT. https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability

Related stories

Anthropic Launches the Anthropic Cyber Mission: Critical-Infrastructure Programme and Free Open-Source Scanner is the nearest TSN account of the OSS Scanner now credited on this Apache advisory.

Also relevant:

• Microsoft’s MDASH Effort Yields 33 Linux Kernel CVEs
• Anthropic Says Unreleased AI Found 62 Chrome Flaws, All Now Patched