A critical vulnerability in Apache HTTP Server’s HTTP/2 module, mod_http2, could allow an unauthenticated attacker to corrupt heap memory and execute code remotely on any server running Apache 2.4.55 through 2.4.70 with HTTP/2 enabled.
Red Hat rates the flaw 9.8 CVSS and reports that a reliable exploit has already been demonstrated against a default Apache configuration with HTTP/2 turned on. Apache released the fix in version 2.4.71 on November 11th, 2026, and Raxis strongly recommends updating as soon as possible.
What CVE-2026-119618 Is
The vulnerability is a race condition in how mod_http2 assigns request headers, which can lead to heap corruption. An attacker only needs network access to the server. No credentials or user interaction are required, and successful exploitation gives the attacker control of the web server process. The flaw was reported to the Apache project on October 26th by Anthropic’s OSS Scanner.
Why Patching in May Wasn’t Enough
Back in May, Apache fixed a different HTTP/2 flaw, CVE-2026-23918, in version 2.4.67. Many organizations patched it, closed the ticket, and moved on. The problem is that every release from 2.4.67 through 2.4.70 is still vulnerable to CVE-2026-119618. If your servers were updated in May and haven’t been touched since, they’re exposed again.
Why This Matters for Defenders
Apache is one of the most widely deployed web servers on the internet, mod_http2 ships with standard builds, and HTTP/2 is widely enabled in production. An unauthenticated RCE on an internet-facing web server is about as direct an initial-access vector as an attacker can ask for.
Version scanners won’t tell the whole story here either. Linux distributions backport security fixes without changing the upstream version number, so a server reporting 2.4.62 may already be patched while one reporting 2.4.68 may not be. Before marking a host as safe or vulnerable, confirm:
- Whether mod_http2 is loaded (apachectl -M | grep http2)
- Whether h2 or h2c appears in the Protocols directive
- Whether the server negotiates HTTP/2 externally (openssl s_client -connect host:443 -alpn h2)
- Whether the installed package’s changelog references CVE-2026-119618
Don’t forget appliances, vendor products that bundle Apache, and container images that haven’t been rebuilt recently.
Patch Status and Mitigation Steps
Apache fixed the flaw in Apache HTTP Server 2.4.71. Distribution patches are still rolling out:
- RHEL 9 and 10: fixes available (Red Hat rates the flaw Important on these releases)
- RHEL 6, 7, and 8: not affected
- Debian bookworm, trixie, and forky: no fix listed yet
- Amazon Linux: fixes pending
- Standalone mod_h2: no fixed release yet
Recommended actions include:
- Upgrading to Apache 2.4.71 or your distribution’s patched package
- Disabling HTTP/2 by removing h2 and h2c from the Protocols directive until a patch is available, since Apache’s advisory offers no official workaround
- Re-checking any servers patched for CVE-2026-23918 in May
- Watching for Apache worker crashes or Apache processes spawning shells
Take a look at the Apache HTTP Server security advisory for more details.
How Raxis Can Help
Our external network penetration testing approaches your perimeter the way an attacker would, discovering exploitable flaws in unpatched software like this. Likewise, our attack surface management service uses automation to find the systems you expose, including appliances and vendor products that bundle Apache, and our pentesters validate what it finds so your team can focus on real risk. The servers patched in May and left alone since are a good example of why one test a year leaves gaps. With Raxis Attack, our Penetration Testing as a Service (PTaaS) offering, testing continues throughout the year, which helps catch systems that slip back into a vulnerable state between annual assessments.
If your Apache servers were last updated in May, we recommend you check them again today.
