---
schema: 1
kind: vulnerability
title: "CVE-2026-119618, Apache HTTP Server 2.4.55 to 2.4.70: a race in mod_http2 assign_headers() corrupts heap memory and leads to remote code execution on servers with HTTP/2 enabled; fixed in 2.4.71, Red Hat calls it unauthenticated and claims public exploit research, no exploitation reported"
headline: "Apache httpd mod_http2 RCE: update to 2.4.71 or drop h2/h2c from Protocols; Debian stable has no fix yet"
summary: >
  The Apache HTTP Server project released 2.4.71 on 2026-11-11 to fix CVE-2026-119618, a race in mod_http2 that it rates critical and says can lead to remote code execution in versions 2.4.55 through 2.4.70; Red Hat adds that it is unauthenticated, affects only servers with HTTP/2 enabled through the Protocols directive, and that public research has demonstrated a reliable exploit, while no source reports exploitation. Red Hat has fixed RHEL 9 and 10, whereas Debian bookworm, trixie and forky are still listed vulnerable.
discovered_at: "2026-11-12T04:12:00Z"
updated_at: null
event_date: "2026-11-11"
run_id: 2026-11-12T0255Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, rce, pre-auth, patch-available]
regions: [global]
sectors: []
entities: ["product:apache-http-server"]
techniques: [T1190]
affected_products: ["Apache HTTP Server"]
cves:
  - id: CVE-2026-119618
    cvss: null
    epss: null
    type: rce
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "Apache HTTP Server 2.4.55 through 2.4.70 with mod_http2 and HTTP/2 enabled; standalone mod_h2 2.0.8 through 2.0.42"
    fixed: "Apache HTTP Server 2.4.71; RHEL 9 mod_http2 2.0.26-7.el9_9.1 and RHEL 10 mod_http2 2.0.29-5.el10_3.1; no fixed standalone mod_h2 named by the project"
sources:
  - url: "https://httpd.apache.org/security/vulnerabilities_24.html"
    publisher: "Apache HTTP Server project"
    date: "2026-11-11"
    role: primary
  - url: "https://access.redhat.com/security/cve/CVE-2026-119618"
    publisher: "Red Hat Product Security"
    date: "2026-11-11"
    role: corroborating
  - url: "https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability"
    publisher: "Wiz"
    date: "2026-11-11"
    role: corroborating
  - url: "https://security-tracker.debian.org/tracker/CVE-2026-119618"
    publisher: "Debian Security Tracker"
    date: "2026-11-12"
    role: corroborating
  - url: "https://access.redhat.com/errata/RHSA-2026:98981"
    publisher: "Red Hat (RHSA-2026:98981, RHEL 9)"
    date: "2026-11-11"
    role: corroborating
  - url: "https://access.redhat.com/errata/RHSA-2026:98978"
    publisher: "Red Hat (RHSA-2026:98978, RHEL 10)"
    date: "2026-11-11"
    role: corroborating
closed_sources: []
evidence:
  - quote: "Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE."
    publisher: "Apache HTTP Server project"
    source_url: "https://httpd.apache.org/security/vulnerabilities_24.html"
  - quote: "Only servers that have HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable."
    publisher: "Red Hat Product Security"
    source_url: "https://access.redhat.com/security/cve/CVE-2026-119618"
  - quote: "It allows unauthenticated remote code execution, and public research has demonstrated a reliable exploit against a default-configured server with the mod_http2 module enabled."
    publisher: "Red Hat Product Security"
    source_url: "https://access.redhat.com/security/cve/CVE-2026-119618"
  - quote: "As of the time of this blog’s publication, no exploit is available and there are no reports of exploitation in the wild."
    publisher: "Wiz"
    source_url: "https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability"
verification: multi-source
sourcing_note: "The project publishes no CVSS and no statement on authentication, the HTTP/2 prerequisite, exploitation or a workaround; those come from Red Hat Product Security and Wiz, who disagree on whether an exploit exists (Wiz said none was available at publication; Red Hat says public research demonstrated a reliable exploit but links none, and no such research was located). The mod_h2 fixed version printed by Wiz contradicts its own affected range, so the project's statement is used."
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "On every internet-facing Apache HTTP Server that loads mod_http2, update to 2.4.71 or to your distribution's fixed package (RHEL 9 mod_http2 2.0.26-7.el9_9.1, RHEL 10 mod_http2 2.0.29-5.el10_3.1) and restart it; where no fixed package exists yet, as on Debian bookworm and trixie, remove h2 and h2c from the Protocols directive until one does, because Red Hat reports an unauthenticated code-execution path and a public exploit, though it rates its RHEL 9 and 10 packages Important rather than Critical for their harder exploitation."
updates: []
migrated_from: null
---

Apache HTTP Server 2.4.71, released on 2026-11-11, fixes CVE-2026-119618, a race in mod_http2's assign_headers() that the project rates critical and says can lead to remote code execution, in versions 2.4.55 through 2.4.70 ([Apache HTTP Server project, 2026-11-11](https://httpd.apache.org/security/vulnerabilities_24.html)). The project publishes no CVSS score; Red Hat scores it CVSS 3.1 9.8 and says it allows unauthenticated remote code execution, with a worker thread writing into memory owned by the connection thread through a shared lock-free allocator ([Red Hat Product Security, 2026-11-11](https://access.redhat.com/security/cve/CVE-2026-119618)). Red Hat states that only servers with HTTP/2 (h2 or h2c) enabled through the Protocols directive are affected and that HTTP/1.1-only servers are not ([Red Hat Product Security, 2026-11-11](https://access.redhat.com/security/cve/CVE-2026-119618)); the project's own page is silent on that prerequisite ([Apache HTTP Server project, 2026-11-11](https://httpd.apache.org/security/vulnerabilities_24.html)).

On exploitation the sources differ. Wiz wrote that no exploit was available and no exploitation in the wild was reported at its publication ([Wiz, 2026-11-11](https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability)), while Red Hat says public research has demonstrated a reliable exploit against a default-configured server with mod_http2 enabled, without linking it ([Red Hat Product Security, 2026-11-11](https://access.redhat.com/security/cve/CVE-2026-119618)); no source reports attacks, and the project's advisory carries no exploitation or workaround statement ([Apache HTTP Server project, 2026-11-11](https://httpd.apache.org/security/vulnerabilities_24.html)). Wiz advises disabling HTTP/2 temporarily as the interim measure ([Wiz, 2026-11-11](https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability)).

The upstream fix is 2.4.71. The project lists standalone mod_h2 releases from GitHub, 2.0.8 through 2.0.42, as affected and names no fixed standalone release ([Apache HTTP Server project, 2026-11-11](https://httpd.apache.org/security/vulnerabilities_24.html)). Red Hat shipped mod_http2 errata for RHEL 9 (mod_http2-2.0.26-7.el9_9.1) and RHEL 10 (mod_http2-2.0.29-5.el10_3.1) on 2026-11-11, rates them Important ([Red Hat, 2026-11-11](https://access.redhat.com/errata/RHSA-2026:98981); [Red Hat, 2026-11-11](https://access.redhat.com/errata/RHSA-2026:98978)), says the packages allocate each HTTP/2 stream from a separate allocator, which makes exploitation substantially more complex, and lists RHEL 8 and earlier as not affected ([Red Hat Product Security, 2026-11-11](https://access.redhat.com/security/cve/CVE-2026-119618)); the Debian tracker lists bookworm, trixie and forky as vulnerable with only the unstable release fixed ([Debian Security Tracker, 2026-11-12](https://security-tracker.debian.org/tracker/CVE-2026-119618)).

**Exposure:** an Apache HTTP Server 2.4.55 to 2.4.70, or a distribution mod_http2 build without the vendor's fix, that has the mod_http2 module loaded and h2 or h2c in a Protocols directive for the server or a virtual host; the loaded modules and the Protocols directives of the configuration show it, and the distribution advisory, not the upstream version string, shows whether a backported fix is installed.

**Detection:** neither the project nor Red Hat publishes indicators of compromise; as an inference from the flaw class, not a source statement, watch for httpd child-process crashes in the error log and for shells or interpreters started by an httpd worker.

**Defender takeaway:** update internet-facing servers that serve HTTP/2 to 2.4.71 or the distribution's fixed package and restart, and where no fix is available yet remove h2 and h2c from Protocols until it is, because Red Hat describes an unauthenticated path and a public exploit while the project describes neither.