The Apache project released Apache HTTP Server 2.4.71 on 11 November 2026. It fixes three flaws and the Apache security team rates one of them critical: an attacker who can reach your web server may use the mod_http2 module to run their own code on it, with no authentication at all. Nobody has confirmed exploitation in the wild so far, but according to Red Hat a working exploit against a default configuration has already been demonstrated publicly. Only servers with HTTP/2 enabled are affected, which today means a large share of websites and applications.

Card for CVE-2026-119618 in Apache HTTP Server: critical severity, public exploit, exploitation unconfirmed, fixed in version 2.4.71.

What happened

Apache HTTP Server delivers websites and applications. Red Hat describes it as the standard web server across Red Hat Enterprise Linux and other products, so it also runs on many servers whose administrators rarely think about it.

CVE-2026-119618 sits in mod_http2, the module that handles the HTTP/2 protocol. HTTP/2 lets a client send many requests at the same time over a single connection and the module processes them in several threads. Because of a thread-safety flaw, one thread can overwrite memory owned by another one (in the assign_headers function). According to Red Hat, the corrupted heap can then be used to run arbitrary commands on the server, over the network and without authentication. That gives an attacker control of the server and access to the data it processes.

The Apache advisory lists versions 2.4.55 through 2.4.70 as affected, and versions 2.0.8 through 2.0.42 of the standalone mod_h2 module from GitHub. The NVD database has not assigned a CVSS score yet, but both the Apache security team and Red Hat Product Security rate the flaw critical. It is not in the CISA KEV catalogue of exploited vulnerabilities (catalogue status 10 November 2026). The flaw was reported by the OSS Scanner of Anthropic and by Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research.

The same release fixes two more flaws: CVE-2026-106023 in mod_md, the module that manages certificates over ACME, where request processing crashes a server child process (versions 2.4.30 through 2.4.70, rated important), and CVE-2026-109163 in mod_vhost_alias, rated low (versions 2.4.69 and 2.4.70).

Does this affect you?

What to do now

  1. Deploy Apache HTTP Server 2.4.71. It fixes all three flaws. On Linux distributions use the package update from your operating system vendor, where mod_http2 is often a separate package.
  2. If you cannot patch right away, turn HTTP/2 off: remove h2 and h2c from the Protocols directive, keep HTTP/1.1 only and restart Apache. Red Hat states this puts the flaw out of reach. Expect pages to load somewhat slower without HTTP/2.
  3. If you use the standalone mod_h2 module from GitHub, move to a version newer than 2.0.42.
  4. After the update, verify the version and that Apache really restarted with the new module.

Neither Apache nor Red Hat has published indicators of compromise for this flaw, and exploitation in the wild has not been confirmed. The publicly demonstrated exploit, however, means the window for patching is short.

Short on time to track this?

Reviewing every day which of the new vulnerabilities affect your own systems, and pushing the fix all the way to deployment, is daily work. If nobody in your organisation can take it on, we can: from knowing what runs where to managing the patches. Write to us through our contact page or look at our security leadership service.

Sources: Apache HTTP Server Project, vulnerabilities fixed in 2.4.71 · Red Hat, assessment and description of CVE-2026-119618 · CISA, Known Exploited Vulnerabilities catalogue