CVE-2026-119618, Apache HTTP Server 2.4.55 to 2.4.70: a race in mod_http2 assign_headers() corrupts heap memory and leads to remote code execution on servers with HTTP/2 enabled; fixed in 2.4.71, Red Hat calls it unauthenticated and claims public exploit research, no exploitation reported
Apache httpd mod_http2 RCE: update to 2.4.71 or drop h2/h2c from Protocols; Debian stable has no fix yet
Defender actions
- On every internet-facing Apache HTTP Server that loads mod_http2, update to 2.4.71 or to your distribution's fixed package (RHEL 9 mod_http2 2.0.26-7.el9_9.1, RHEL 10 mod_http2 2.0.29-5.el10_3.1) and restart it; where no fixed package exists yet, as on Debian bookworm and trixie, remove h2 and h2c from the Protocols directive until one does, because Red Hat reports an unauthenticated code-execution path and a public exploit, though it rates its RHEL 9 and 10 packages Important rather than Critical for their harder exploitation.
Analysis
Apache HTTP Server 2.4.71, released on 2026-11-11, fixes CVE-2026-119618, a race in mod_http2's assign_headers() that the project rates critical and says can lead to remote code execution, in versions 2.4.55 through 2.4.70 (Apache HTTP Server project, 2026-11-11). The project publishes no CVSS score; Red Hat scores it CVSS 3.1 9.8 and says it allows unauthenticated remote code execution, with a worker thread writing into memory owned by the connection thread through a shared lock-free allocator (Red Hat Product Security, 2026-11-11). Red Hat states that only servers with HTTP/2 (h2 or h2c) enabled through the Protocols directive are affected and that HTTP/1.1-only servers are not (Red Hat Product Security, 2026-11-11); the project's own page is silent on that prerequisite (Apache HTTP Server project, 2026-11-11).
On exploitation the sources differ. Wiz wrote that no exploit was available and no exploitation in the wild was reported at its publication (Wiz, 2026-11-11), while Red Hat says public research has demonstrated a reliable exploit against a default-configured server with mod_http2 enabled, without linking it (Red Hat Product Security, 2026-11-11); no source reports attacks, and the project's advisory carries no exploitation or workaround statement (Apache HTTP Server project, 2026-11-11). Wiz advises disabling HTTP/2 temporarily as the interim measure (Wiz, 2026-11-11).
The upstream fix is 2.4.71. The project lists standalone mod_h2 releases from GitHub, 2.0.8 through 2.0.42, as affected and names no fixed standalone release (Apache HTTP Server project, 2026-11-11). Red Hat shipped mod_http2 errata for RHEL 9 (mod_http2-2.0.26-7.el9_9.1) and RHEL 10 (mod_http2-2.0.29-5.el10_3.1) on 2026-11-11, rates them Important (Red Hat, 2026-11-11; Red Hat, 2026-11-11), says the packages allocate each HTTP/2 stream from a separate allocator, which makes exploitation substantially more complex, and lists RHEL 8 and earlier as not affected (Red Hat Product Security, 2026-11-11); the Debian tracker lists bookworm, trixie and forky as vulnerable with only the unstable release fixed (Debian Security Tracker, 2026-11-12).
Cited evidence
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.
Only servers that have HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable.
It allows unauthenticated remote code execution, and public research has demonstrated a reliable exploit against a default-configured server with the mod_http2 module enabled.
As of the time of this blog’s publication, no exploit is available and there are no reports of exploitation in the wild.
Sources6
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.