Apache fixes HTTP/2 flaw that could enable remote code execution

Apache has patched a critical HTTP Server vulnerability that could allow unauthenticated remote code execution (RCE) on systems with HTTP/2 enabled, discovered independently by Anthropic and Google researchers. The flaw, tracked as CVE-2026-119618, affects Apache HTTP Server versions 2.4.55 through 2.4.70 and was addressed with the release of version 2.4.71 on 11 November 2026.

The issue resides in mod_http2, the module that handles HTTP/2 traffic, and stems from a race condition where multiple threads can improperly access shared resources, potentially leading to memory corruption.

Red Hat’s advisory describes a remote, unauthenticated exploit that could allow arbitrary command execution and control of the server process, assigning the vulnerability a CVSS score of 9.8. It notes that only servers with HTTP/2 enabled are affected; those serving only HTTP/1.1 are not vulnerable. Apache credited Anthropic’s OSS Scanner for reporting the flaw on 26 October, with Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research independently reporting the same issue on 3 November.

Wiz reported that 64% of cloud environments in its data contained resources running affected Apache versions, and 51% had publicly exposed instances, though the firm cautioned that configuration details could affect exploitability. A publicly available PoC on GitHub documents memory corruption and Apache process crashes but does not demonstrate remote code execution.

Users are advised to upgrade to Apache HTTP Server 2.4.71 or apply vendor packages; disabling HTTP/2 can temporarily mitigate if immediate patching is not possible.