TL;DR
Apache released HTTP Server 2.4.71 on November 11 to fix CVE-2026-119618, a critical flaw in mod_http2 that Apache says can lead to remote code execution. Servers with HTTP/2 enabled may be affected; distribution packages and affected products vary. Public reports of attacks were absent in sources checked on November 12, but Red Hat says public research has demonstrated a reliable exploit.
Apache lists Apache HTTP Server versions 2.4.55 through 2.4.70 as affected, along with standalone mod_h2 releases from GitHub numbered 2.0.8 through 2.0.42. The upstream fix is Apache HTTP Server 2.4.71. Administrators using distribution packages should check the relevant vendor advisory and package status, since distribution versions and fixes can differ from upstream releases.
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Apache describes the issue as a thread synchronization flaw in mod_http2’s assign_headers() function, involving shared resources and heap corruption. Red Hat says one thread can modify memory belonging to another, potentially allowing a remote attacker to execute commands without authentication. Red Hat assigns a CVSS 3.1 score of 9.8; NVD had not published its own score by November 12.
Exposure depends on configuration. Red Hat says servers with HTTP/2 enabled through the Protocols directive, using h2 or h2c, are affected; servers serving only HTTP/1.1 are not. Apache documentation gives “Protocols http/1.1” as the default, but operators should inspect their actual configuration rather than assume the default remains in place.
HTTP/2 Configuration Determines Exposure
The flaw could put web servers at risk of remote command execution, a serious outcome because an attacker may be able to run commands on a reachable server. Red Hat says exploitation does not require authentication. That makes identifying HTTP/2-enabled systems and applying the relevant vendor fix time-sensitive work for administrators.
Wiz reported that 64% of cloud environments in its customer data had resources vulnerable to the CVE, and that 51% had publicly exposed instances. Wiz cautioned that its figures do not account for configuration, so they do not establish how many servers were actually exploitable. They are an indication of potential exposure in that dataset, not a census of affected systems.
The reported exploit status also calls for care. Wiz said on November 11 that it knew of no in-the-wild exploitation, while Red Hat said public research had demonstrated a reliable exploit against a default-configured server with mod_http2 enabled. These statements describe different evidence; the available material does not identify the research or establish that attackers are using it.
Products Worth Considering
DJI Mini 3 Drone with DJI RC and 3-Axis Gimbal
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Kindle Paperwhite Signature Edition 32GB E-Reader, 7-Inch Display, Seaglass Green
As an affiliate, we earn on qualifying purchases.
Fixes and Vendor Status on November 12
Apache credited Anthropic’s OSS Scanner and two researchers from Google Cloud Vulnerability Research with finding the flaw. Apache’s advisory says Anthropic’s report arrived on October 26, followed by the Google Cloud researchers’ report on November 3. The CVE.org record says the identifier was reserved on October 30. Apache published the fixed release on November 11.
Red Hat shipped fixed packages on November 11, including advisories RHSA-2026:98981 for RHEL 9 and RHSA-2026:98978 for RHEL 10. Red Hat rates the issue critical overall, but important for RHEL 9 and 10, citing their separate allocator for each HTTP/2 stream as a factor that increases exploitation complexity. Red Hat says RHEL 8 and earlier are not affected; its JBoss Core Services and Hardened Images were still listed as affected when checked.
Debian listed stable bookworm and trixie as vulnerable, with version 2.4.71-1 available in unstable, or sid, at the time of checking. No published Ubuntu or SUSE advisory was found in the source material as of November 12. Those findings are time-specific; package status can change, and administrators should consult current vendor notices.
““Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server’s mod_http2 in assign_headers() can lead to RCE.””
— Apache HTTP Server security advisory
Exploit Activity Remains Unverified
Sources checked on November 12 did not establish whether attackers had used CVE-2026-119618. Wiz reported no known in-the-wild exploitation on November 11, and CISA’s Known Exploited Vulnerabilities catalog did not list the CVE when checked. The cited CISA catalog was released before the CVE became public, so its absence is not evidence that exploitation has not occurred.
Red Hat’s account of reliable exploit research raises a separate concern, but the source material does not name the researchers or link to public exploit code. The number of HTTP/2-enabled systems that are vulnerable, and the current patch status across all Linux distributions and affected products, also remain unclear.
Check Protocols and Apply Vendor Fixes
Administrators should identify Apache servers running affected versions, inspect whether h2 or h2c is enabled, and apply Apache 2.4.71 or the fixed package supplied by their operating system vendor. For systems that cannot be patched immediately, confirm exposure with the vendor’s guidance and review whether HTTP/2 can be disabled safely for that deployment.
Operators should monitor Apache and distribution advisories for updated package guidance, and check authoritative sources for any change in exploitation status. The information here reflects reports available through November 12, 2026; vendor listings and threat reporting may change.
Key Questions
Which Apache versions are listed as affected?
Apache lists HTTP Server versions 2.4.55 through 2.4.70, plus standalone mod_h2 versions 2.0.8 through 2.0.42 from GitHub. Apache HTTP Server 2.4.71 contains the upstream fix.
Are servers that only serve HTTP/1.1 affected?
Red Hat says servers serving only HTTP/1.1 are not affected. Check the actual Protocols configuration to determine whether HTTP/2, including h2 or h2c, is enabled.
Has the flaw been exploited in real attacks?
The sources checked had not confirmed in-the-wild exploitation. Wiz reported no known attacks on November 11, while Red Hat said public research had demonstrated a reliable exploit. The available material does not resolve whether attackers have used it.
What should administrators do?
Check affected versions and HTTP/2 settings, then install Apache 2.4.71 or the fixed package from the relevant vendor. Distribution package status differed as of November 12, so consult current vendor advisories.
Source: Thorsten Meyer AI
