Science & Tech · Cybersecurity · 15 hrs ago
Apache fixes critical HTTP/2 flaw that could let attackers run server code
Apache fixed a critical flaw in its HTTP/2 module that could let attackers run code on affected web servers.
The flaw, tracked as CVE-2026-119618, stems from a timing problem that can corrupt the server’s memory.
It affects Apache HTTP Server versions 2.4.55 to 2.4.70, but only when HTTP/2 is enabled; standalone mod_h2 versions 2.0.8 to 2.0.42 are also affected.
The Apache project’s fixed release is version 2.4.71, while some software distributors provide fixes through their own packages.
Admins who cannot update should disable HTTP/2 by removing h2 and h2c from the server’s Protocols settings.
Reports differ on whether a reliable public exploit exists, but no attacks in the wild have been reported.
Updating or disabling HTTP/2 can reduce the risk while administrators check server-wide and individual website settings.
Apache fixed a critical flaw in its HTTP/2 module that could let unauthenticated attackers run code on affected servers.
The flaw, tracked as CVE-2026-119618, affects Apache HTTP Server versions 2.4.55 through 2.4.70 when HTTP/2 is enabled.
Apache’s fixed release is version 2.4.71; standalone mod_h2 versions 2.0.8 through 2.0.42 are also affected.
The vulnerability is a race condition that can corrupt heap memory and let an attacker run code with the web server process’s privileges.
Wiz reported that it knew of no public exploits or attacks, while Red Hat said public research had demonstrated a reliable exploit.
- Who
- Unauthenticated remote attackers could exploit the flaw. The Apache Software Foundation issued a fix.
- What
- A race condition in the mod_http2 module can cause heap corruption and remote code execution.
- When
- Apache released the fix in version 2.4.71 on November 11, 2026, according to The Hacker News.
- Where
- Apache HTTP Server systems with HTTP/2 enabled; standalone mod_h2 builds are also affected.
- Why
- Improper synchronization when concurrent threads share resources can corrupt memory and allow code execution.
Red Hat
Wiz
Exploit status
Red Hat
Red Hat said public research had demonstrated a reliable exploit against a server in its default configuration with mod_http2 enabled.
Wiz
Wiz said it knew of no available public exploit and no exploitation in the wild.
Apache released version 2.4.71, which fixes the flaw.
Red Hat published its assessment, saying public research had demonstrated a reliable exploit.
Wiz said it knew of no available exploit and no exploitation in the wild.
- CVE
- CVE-2026-119618
- Affected Apache versions
- 2.4.55 through 2.4.70
- Fixed Apache version
- 2.4.71
- Affected standalone module versions
- mod_h2 2.0.8 through 2.0.42
- HTTP/2 setting
- Affected only when HTTP/2 is enabled
3 sources
What people are saying
patch now or drop h2 until you can.
Due to improper synchronization when executing concurrent threads sharing resources, an attacker can trigger heap corruption.
public research has demonstrated a reliable exploit