Apache fixes HTTP/2 flaw that could enable remote code execution

CVE-2026-119618 is a critical race-condition in Apache HTTP Server’s mod_http2 that can lead to remote code execution. Apache has released Apache HTTP Server 2.4.71 to fix the flaw, affecting servers running 2.4.55 through 2.4.70 with HTTP/2 enabled. The attacker requires no credentials or user interaction.

The vulnerability sits in concurrent execution using a shared resource in the assign_headers() function of mod_http2, where two threads handling HTTP/2 traffic may touch the same memory without proper synchronization, potentially causing heap corruption that could be steered toward code execution. Apache has not disclosed the exact triggering request sequence; the public technical detail available is the fix commit.

Successful code execution would likely occur in the httpd worker process, with privilege escalation to root requiring a separate step. Red Hat assigns a CVSS 3.1 base score of 9.8, while Red Hat’s own product rating deems it Important for RHEL 9 and 10 due to allocator design differences; RHEL 8 and earlier are not affected.

The guidance on affected configurations notes that the impact depends on a server’s Protocols directive, since HTTP/2 (h2 or h2c) must be loaded for exposure. Standalone mod_h2 has no fixed release, and various distributions have applied patches at different times. As of mid-November 2026, Red Hat and Debian had issued fixes for their respective distributions, while Ubuntu and some others had not published CVE notices yet.

Some researchers describe public exploit demonstrations, but there is no confirmed PoC widely verified as of 13 November 2026, and CISA KEV does not list this CVE as exploited. Practical responses include upgrading to 2.4.71 or patched packages and, if patching is delayed, removing h2/h2c from Protocols or unloading mod_http2 temporarily, subject to service dependencies. Practical steps for web server teams are outlined by SOCRadar.