Apache has patched a critical vulnerability in its HTTP Server that could allow unauthenticated remote code execution. The flaw, tracked as CVE-2026-119618, affects versions 2.4.55 through 2.4.70 and was addressed with the release of version 2.4.71 on November 11.
The issue resides in mod_http2, the module responsible for handling HTTP/2 traffic. It involves a race condition in which multiple threads improperly access shared resources, potentially corrupting server memory. According to Red Hat, an attacker could exploit the issue remotely without authentication to execute arbitrary commands and gain control of the server process.
Red Hat assigned the vulnerability a CVSS score of 9.8 and explained that only servers that have HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable. Apache credited Anthropic’s OSS Scanner with reporting the flaw on October 26. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research independently reported the same vulnerability on November 3.
Cloud security firm Wiz reported that 64% of cloud environments in its data contained resources running affected Apache versions, while 51% had publicly exposed instances. The company cautioned that these figures do not account for server configuration, so they do not necessarily represent exploitable installations.
Red Hat says public research has demonstrated a reliable exploit against a server with mod_http2 enabled, but its advisory does not identify the research. Wiz noted that when its blog was published on November 11, no exploit was available and there were no reports of exploitation in the wild. A publicly available proof of concept on GitHub reports reproducing memory corruption and Apache process crashes, but does not demonstrate remote code execution.
Organizations are advised to install Apache HTTP Server 2.4.71 or vendor-supplied packages. Disabling HTTP/2 can temporarily prevent exploitation if updates cannot be deployed immediately. Defiant also warned that WordPress security updates cannot resolve the issue because it affects the underlying web server.
Apache HTTP Server 2.4.71 also fixes two other vulnerabilities: CVE-2026-106023, an important issue that can crash server processes, and CVE-2026-109163, a low-severity stack buffer overflow.
