Critical Apache mod_http2 Flaw (CVE-2026-119618): Patch Now

A newly disclosed flaw in Apache HTTP Server's mod_http2 module, CVE-2026-119618, lets an unauthenticated remote attacker corrupt server memory and potentially execute arbitrary code on any site running HTTP/2 with an affected build. The Apache Software Foundation (ASF) rates it critical and fixed it in Apache HTTP Server 2.4.71, released November 11, 2026. It affects versions 2.4.55 through 2.4.70. There is no evidence of active exploitation as of this writing, but given the flaw requires no authentication and is reachable over the network, administrators running mod_http2 should patch without waiting for a maintenance window.

What is CVE-2026-119618?

CVE-2026-119618 is a heap-corruption vulnerability in mod_http2, the module that gives Apache HTTP Server its HTTP/2 support. According to the Apache Software Foundation's own vulnerability page, the bug lives in a function called assign_headers() and is described as a "Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() [that] can lead to RCE." The same wording appears in the official CVE.org record and in the NVD entry, both tracked under CWE-362.

In plain terms: HTTP/2 lets a single connection carry many requests at once, and mod_http2 hands those concurrent requests off to multiple worker threads. The assign_headers() routine is supposed to safely build the header set for each stream, but a missing or incomplete synchronization lets two threads touch the same shared memory at the same time. That race can corrupt heap memory, and heap corruption in a network-facing C module is often a path to remote code execution, not just a crash.

Because the flaw sits in header assignment during request processing, it is triggered simply by sending crafted, concurrent HTTP/2 traffic — no login, no special configuration, no user interaction. That is what pushes the severity rating so high.

How severe is it, exactly?

Apache's advisory itself does not publish a numeric CVSS score for this entry — the ASF's vulnerability page labels it only with the textual rating "critical," its highest category. As of this writing, the NVD record's status is "Received," meaning NVD has logged the CVE but not yet completed its own independent CVSS analysis or published a score.

A numeric score of 9.8 out of 10, using the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, has circulated from downstream vendor scoring rather than from Apache or NVD directly. That vector describes a flaw exploitable over the network (AV:N), with low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N), with high impact to confidentiality, integrity, and availability — consistent with Apache's own "critical" rating and with a race condition that can corrupt memory on an internet-facing server. We're flagging the 9.8 figure as a third-party calculation rather than an Apache- or NVD-confirmed number, since neither primary source had published its own numeric score at publication time.

Which versions are affected?

Per the ASF advisory and the matching CVE record, the vulnerable range is precise:

That range spans roughly three years of releases — 2.4.55 shipped in 2023 — which means a large share of currently deployed Apache servers with HTTP/2 turned on are theoretically in scope. The flaw does not affect installations that serve HTTP/1.1 only, since the vulnerable code path lives entirely inside the optional mod_http2 module.

The root cause: a thread-safety bug under concurrent load

HTTP/2's whole design point is multiplexing — many logical requests (streams) riding one TCP connection at once. Apache's mod_http2 implementation distributes that work across a pool of threads so one slow stream doesn't block the others. assign_headers() is part of the bookkeeping that maps parsed header blocks back to the correct stream/request structure.

A race condition means the correctness of that bookkeeping depends on timing: if two threads reach the shared data structure in an unlucky order, one can read or write memory that the other thread still considers its own, or free memory that is still in use elsewhere. The result is heap corruption — overwritten pointers, freed-and-reused buffers — which is the ingredient CWE-362 entries share with classic use-after-free and double-free bugs. mod_http2 has had a run of exactly this type of defect in 2026: a double-free (CVE-2026-23918, fixed in 2.4.67), a use-after-free tied to exhausted file handles (CVE-2026-48913, fixed in 2.4.68), an oversized-allocation denial-of-service issue (CVE-2026-49975, fixed in 2.4.68), and a use-after-free in shared session buffers (CVE-2026-57941, fixed in 2.4.69). CVE-2026-119618 is the latest and most severe entry in that string, and it is specifically why the ASF calls it out as leading to RCE rather than "only" a crash.

Is it being exploited in the wild?

No. Based on what has been disclosed so far, there is no confirmed exploitation in the wild for CVE-2026-119618. The vulnerability is also not present in CISA's Known Exploited Vulnerabilities (KEV) catalog as of publication — CISA adds entries to that list only once it has evidence of active exploitation, and this CVE has no entry there.

That status can change quickly. Critical, unauthenticated, network-reachable memory-corruption bugs in widely deployed web server software are exactly the category that attackers reverse-engineer from patch diffs within days of disclosure, once the fixed 2.4.71 source is public and the specific code change in assign_headers() can be compared against the vulnerable version. Treat "no known exploitation yet" as a current snapshot, not a guarantee — the same caution applied to other recently disclosed flaws, such as the FreeSWITCH vulnerability that CISA later confirmed was under active attack, which started out with the same "not yet observed" status before exploitation was confirmed.

Cloud security researchers at Wiz, who published their own analysis of the flaw around the same time as disclosure, likewise reported no evidence of in-the-wild exploitation at the time of their report. That lines up with the CVE record's own credit trail: Wiz is not listed as a finder on the official CVE.org or Apache advisory entries — the credited reporters are Anthropic's OSS Scanner and two named researchers from Google Cloud Vulnerability Research, covered in the next section. Multiple independent write-ups converging on "no known exploitation yet" is a reasonable basis for calling the current risk theoretical-but-urgent, rather than describing the flaw as already under attack.

Who found it, and how it was reported

The CVE record and Apache's own advisory credit two separate finders. The issue was first reported to Apache's security team on October 26, 2026 by Anthropic's OSS Scanner, tracked internally as vulnerability ANT-2026-MAPKT6MZ, followed on November 3, 2026 by an independent report from Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research. The ASF fixed the flaw in the 2.4.x branch on November 11, 2026, and shipped it the same day in the 2.4.71 release. That is a roughly 16-day window from first report to public fix — fast by the standards of a widely used open-source server, though it also means defenders effectively learned about the bug and the patch at the same moment.

How this lands relative to November's patch cycle

CVE-2026-119618's disclosure falls in the same week as November 2026's Patch Tuesday roundup, though Apache HTTP Server updates run on their own release schedule and aren't tied to Microsoft's monthly cycle. For teams tracking a growing pile of November advisories — including the recently disclosed IBM API Connect flaws — mod_http2's CVE-2026-119618 is worth separating out and prioritizing on its own, given the combination of critical severity, no authentication requirement, and the breadth of affected versions (over three years of 2.4.x releases).

What to do now

If you run Apache HTTP Server with mod_http2 enabled anywhere in your infrastructure — origin servers, reverse proxies, load balancers, embedded appliances that bundle httpd — treat this as a same-week patch, not a next-cycle one.

1. Check your version. Run httpd -v (or apachectl -v, or apache2 -v on Debian/Ubuntu-based systems) to see the installed version string. Anything from 2.4.55 up to and including 2.4.70 is in the affected range.
2. Upgrade to 2.4.71. This is the only version that contains the fix. Grab it from the official Apache HTTP Server download page, which lists 2.4.71 as the current recommended release, or through your Linux distribution's package manager once it has shipped a backported or rebuilt package. Always verify the signature or checksum of any tarball you download directly from Apache's mirrors.
3. If you can't patch immediately, disable mod_http2 as a stopgap. Since the vulnerable code path only runs when HTTP/2 is active, removing or commenting out the module load directive (and any Protocols h2 / Protocols h2 h2c http/1.1 lines) forces connections down to HTTP/1.1, which is not affected by this specific flaw. This costs you HTTP/2's performance benefits until you can upgrade, but it closes the hole in the meantime.
4. Check embedded and bundled httpd instances, not just your main web tier. Apache HTTP Server ships inside many appliances, CI/CD tools, API gateways, and management consoles. Inventory anything that embeds httpd 2.4.x and confirm its version separately — vendors may need to ship their own updates.
5. Watch your WAF and IDS feeds. Given the flaw involves concurrent HTTP/2 stream handling, unusual spikes in HTTP/2 connection resets, worker-process crashes, or crash-loop restarts of httpd processes after the disclosure date are worth investigating even if you've already patched elsewhere in the fleet.
6. Track the KEV catalog and vendor advisories. If CISA later adds CVE-2026-119618 to its Known Exploited Vulnerabilities catalog, or your distribution's security tracker upgrades its exploitation-status field, treat that as the signal to move any remaining unpatched instances to the front of the queue.

Background: why mod_http2 keeps producing these bugs

Apache HTTP Server, first released in 1995, remains one of the most widely deployed web server platforms, and HTTP/2 support via mod_http2 has been a core feature since the 2.4.17 release in 2015, per its entry on Wikipedia. HTTP/2's multiplexing model is also precisely what makes modules implementing it hard to get right: instead of one request per connection handled start-to-finish by a single thread, the server must safely share connection- and session-level state across concurrent streams and the threads processing them. Every one of the mod_http2 CVEs patched in 2.4.67 through 2.4.71 traces back to some version of that same challenge — freeing something too early, sharing a buffer without a lock, or, in this case, writing to shared header state from more than one thread without proper synchronization. It's a pattern worth watching for any organization running Apache with HTTP/2 enabled: this module has had five distinct memory-safety CVEs patched across roughly five point releases in a single year.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage