Apache HTTP Server Patches Critical HTTP/2 Remote Code Execution Flaw in mod_http2
The Apache Software Foundation has released patches for a critical race condition vulnerability in the HTTP/2 module of Apache HTTP Server that could allow unauthenticated attackers to achieve remote code execution. Tracked as CVE-2026-119618, the flaw affects versions 2.4.55 through 2.4.70 and standalone mod_h2 versions 2.0.8 through 2.0.42. Discovered by Anthropic’s OSS Scanner and Google Cloud’s Vulnerability Research teams, the issue stems from improper synchronization in assign_headers() within mod_http2, leading to heap memory corruption. Telemetry from Wiz indicates that 64% of cloud environments contain vulnerable resources, with roughly half publicly exposed, although HTTP/2 must be explicitly enabled. The update also resolves two additional issues: CVE-2026-106023 in mod_md and CVE-2026-109163 in mod_vhost_alias. Researchers at watchTowr urge immediate patching or disabling HTTP/2 until updates are applied.
BleepingComputerNov 12, 2026Translated from English