Apache HTTP Server CVE-2026-119618: critical HTTP/2 flaw allows remote code execution

The Apache project released version 2.4.71 on 11 November 2026 to fix the critical CVE-2026-119618 in mod_http2. Versions 2.4.55 through 2.4.70 with HTTP/2 enabled are affected.

Apache HTTP Server is one of the most widely deployed web servers and runs a large share of company websites, shops and internal apps. According to The Hacker News and Cybersecurity News, the Apache project released version 2.4.71 on 11 November 2026 to fix a critical flaw, CVE-2026-119618, in the mod_http2 module. It is a race condition (CWE-362) in the assign_headers() function that can corrupt heap memory. An unauthenticated attacker on the internet could potentially take control of the server process.

Which versions are affected? According to the available reports, Apache HTTP Server 2.4.55 through 2.4.70, plus standalone mod_h2 releases 2.0.8 through 2.0.42 from GitHub. Per Red Hat, only servers with HTTP/2 enabled are exposed. The same 2.4.71 release also fixes two lower-severity issues, CVE-2026-106023 and CVE-2026-109163.

Is it already exploited? One source says there is no indication of exploitation in the wild so far. Public details usually lead to mass internet scanning quickly, so do not postpone the update. Linux distributions often backport the fix without changing the version number, so besides the output of httpd -v, check your distribution's own advisory.

What should you do now? Update to 2.4.71, or to a distribution package that contains the fix, and restart the service. If that is not possible immediately, one source suggests disabling HTTP/2 on internet-facing servers as a temporary measure. After updating, confirm the site runs and review the logs for suspicious requests from before the patch.