Apache HTTP Server administrators have a fix for a vulnerability that could let remote attackers run commands without logging in when HTTP/2 is enabled. Version 2.4.71, released November 11, addresses CVE-2026-119618; Red Hat’s assessment says exploitation could give attackers control of the server process, allowing data access or modification and service disruption.
The affected Apache releases span 2.4.55 through 2.4.70, The Hacker News reported on November 12. Exposure requires HTTP/2: a server handling only HTTP/1.1 traffic is unaffected. Organizations using Linux distribution packages must check their vendor’s release information because those packages carry separate version numbers and fixes.
Red Hat gives the vulnerability a CVSS severity score of 9.8 out of 10 and rates it Critical overall, with lower ratings for certain products. Its November 11 assessment says public research demonstrated reliable exploitation of a default-configured server with mod_http2 enabled. The Hacker News also relayed a conflicting statement from security company Wiz later that day: no exploit was available, and no exploitation in the wild had been reported.
Configuration determines exposure
Administrators can establish whether HTTP/2 is active by inspecting Apache’s Protocols directive. The value h2 enables the protocol over TLS, which encrypts the connection; h2c enables it over unencrypted TCP. Settings can cover the entire server or individual virtual hosts, the configurations used to serve separate sites, so both levels need checking.
HTTP/2 carries several requests concurrently over one connection. In Apache, mod_http2 divides that work among threads—separate execution paths inside the server process. Red Hat describes a memory-handling error in which a request worker writes into memory belonging to the thread managing the connection.
The threads share a lock-free allocator, a mechanism that assigns memory without coordinating access through locks. The faulty interaction corrupts internal memory and can enable command execution by an attacker with network access to the server, without credentials or user interaction.
Packaging changes the difficulty of that attack. Red Hat Enterprise Linux (RHEL) 9 and 10 assign a separate allocator to each HTTP/2 stream, substantially increasing exploitation complexity, Red Hat says. Those releases receive an Important rating rather than Critical. The vulnerable code was introduced in mod_http2 2.0.8; earlier module versions and RHEL 8 and older are unaffected.
Standalone mod_h2 builds distributed through GitHub are vulnerable from 2.0.8 through 2.0.42. As of the November 12 report, their release list stopped at 2.0.42, leaving no fixed standalone release. The repository was archived on June 9 and has been read-only since then.
The Hacker News dates a report of the flaw by Anthropic’s OSS Scanner to October 26. That free service scans open-source projects using Anthropic’s AI models. It also says Google Cloud Vulnerability Research’s Anthony Weems and Simon Scannell reported the issue “last week”; Red Hat acknowledges both researchers.
Select the fix for the deployed build
For installations using Apache’s own releases, administrators should install 2.4.71, the corrected version identified in Apache’s security advisory, as reported by The Hacker News. It also repairs an Important-rated crash in mod_md and a Low-rated one-byte stack-memory overwrite in mod_vhost_alias.
A previous HTTP/2 fix is insufficient: Apache 2.4.67, released May 4, addressed CVE-2026-23918, but that version and subsequent releases through 2.4.70 remain within the new flaw’s affected range.
Red Hat delivered updates on November 11. The packages and advisories listed in The Hacker News report are:
- RHEL 9:
mod_http2-2.0.26-7.el9_9.1, covered by RHSA-2026:98981. - RHEL 10:
mod_http2-2.0.29-5.el10_3.1, covered by RHSA-2026:98978. - RHEL 9.4 Update Services for SAP Solutions: a fix under RHSA-2026:98968.
- RHEL 9.6, 9.8, 10.0 and 10.2 Extended Update Support: fixes under RHSA-2026:98954, RHSA-2026:98982, RHSA-2026:98953 and RHSA-2026:98979, respectively. Administrators should obtain the package specified in their release’s advisory.
The report lists Red Hat JBoss Core Services and Red Hat Hardened Images as affected, with no fixes listed. Red Hat also cautions that products built on affected components, including container-based offerings, may be exposed without appearing separately in its affected-product table.
Elsewhere, availability remained uneven on November 12. The Hacker News, citing Debian’s security tracker, lists unstable—also called sid—as fixed in apache2 2.4.71-1. Debian bookworm, trixie and forky were marked vulnerable without listed fixes. Amazon’s tracker showed fixes pending for Amazon Linux 2 (Core), Amazon Linux 2023 and Amazon Linux 2027 Preview. Ubuntu’s tracker had no page for this CVE when the publication checked.
For Red Hat systems, an upstream version comparison alone can produce a misleading alert. The vendor backports fixes into existing package versions to preserve compatibility, so a scanner may flag a corrected package if it checks only its version number. Red Hat recommends a scanner approved through its Vulnerability Scanner Certification program.
Administrators awaiting an update can disable HTTP/2. Apache’s advisory supplies no workaround, The Hacker News reports, but Wiz recommends removing h2 and h2c from the applicable Protocols settings, leaving Protocols http/1.1. The same configuration change applies to affected standalone mod_h2 installations.
