An explainer on a vulnerability in Apache HTTP Server's mod_http2 that can lead to remote code execution (RCE). It covers what happens, who is affected and how to respond, from a defender's point of view and without attack steps.
- CVE
- CVE-2026-119618 (Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers)
- Severity
- Apache rating: critical (its highest level). No CVSS score in Apache's advisory or the CVE.org record (Red Hat assigns its own 9.8)
- Type
- Concurrent use of a shared resource without proper synchronization (CWE-362); heap corruption leading to RCE
- Affected
- Apache HTTP Server 2.4.55 through 2.4.70. mod_h2 on GitHub: 2.0.8 through 2.0.42
- Fix
- Apache HTTP Server 2.4.71 (released 11 November 2026)
- Fixed alongside
- CVE-2026-106023 (mod_md, important), CVE-2026-109163 (mod_vhost_alias, low)
- Exploitation
- No real-world exploitation reported (Red Hat says published research demonstrated an attack). Not in the 10 November edition of CISA KEV
- Workaround
- None listed in Apache's advisory
The version string alone is not enough
Debian, Red Hat and others sometimes backport a fix without changing the version number. apache2 -v or httpd -v may look old on a patched system. Conversely, do not rely on the version string to feel safe: check the package changelog or the distribution's advisory.
What kind of vulnerability is it
Apache's advisory says that in assign_headers() in mod_http2, shared resources are used concurrently without proper synchronization, which leads to heap corruption and can lead to remote code execution. It is classified as CWE-362.
- Apache's advisory gives no detailed conditions for exploitation, and this site does not guess at them.
- It was found through two separate reports. The developer of an AI-based code analysis tool reported it to Apache's security team on 26 October 2026, and a cloud provider's security research team on 3 November.
- Apache merged the fix into the 2.4 branch on 11 November and released 2.4.71 the same day.
- The standalone mod_h2 distributed on GitHub is also affected (2.0.8 through 2.0.42). If you installed it separately from the mod_http2 bundled with Apache, check that too.
Affected scope
| Item | Detail |
|---|---|
| Product | Apache HTTP Server (mod_http2) |
| Affected versions | 2.4.55 through 2.4.70 |
| Fixed version | 2.4.71 |
| Standalone mod_h2 (GitHub) | 2.0.8 through 2.0.42 affected |
| Severity | Apache: critical (no CVSS). Red Hat assigns its own 9.8 |
| Workarounds / mitigations | None listed in Apache's advisory |
- 2.4.54 and earlier are outside the advisory's range. Older versions carry other accumulated vulnerabilities, so consider updating anyway.
- The advisory does not say that only HTTP/2-enabled setups are affected. The next section's information is Red Hat's.
The other two issues fixed in the same 2.4.71
| CVE | Description | Apache rating | Affected versions |
|---|---|---|---|
| CVE-2026-106023 | mod_md: a NULL pointer dereference crashes a child process | important | 2.4.30 through 2.4.70 |
| CVE-2026-109163 | mod_vhost_alias: a 1-byte stack buffer overwrite (a remaining issue after the CVE-2026-63292 fix) | low | 2.4.69 and 2.4.70 |
Updating to 2.4.71 fixes all three.
Distribution status (as of 13 November 2026)
| Vendor | Status |
|---|---|
| Debian | The security tracker lists bookworm (12) as fixed in 2.4.71-1 |
| Ubuntu | Every release is "Needs evaluation"; no fixed version listed. Priority: High |
| Red Hat | RHEL 9 and 10 are affected, rated Important. RHEL 8 and earlier are not affected. See Red Hat's security bulletin RHSB-2026-017 for the procedure |
- Red Hat explains that RHEL 9 and 10 are rated Important rather than Critical because each HTTP/2 stream gets its own memory allocator (allocating each stream from a separate allocator makes exploitation harder, according to Red Hat).
- This table is a dated check and will change. Verify the latest on each vendor's page for your environment.
How to check whether you are affected
Check the Apache version
Run apache2 -v (Debian family) or httpd -v (RHEL family). 2.4.55 through 2.4.70 may be affected. A distribution package can carry the fix under the same version number, so compare the package changelog with the vendor's security information.
Check whether HTTP/2 is enabled
Look for Protocols h2 or h2c in the configuration, and whether the http2 module is loaded (output of apachectl -M). Per Red Hat, HTTP/2-enabled servers are affected and HTTP/1.1-only servers are not vulnerable. That is Red Hat's statement; Apache's advisory draws no such distinction.
Find every place Apache runs
Besides web servers, look for Apache embedded in products (admin consoles, appliances). For how to keep a list, see the asset inventory checklist.
What to do today
Update to 2.4.71 or your distribution's fixed package (top priority)
For Apache you built yourself, move to 2.4.71. For packaged installs, check the vendor's page for a fixed package and update. After updating, restart or reload Apache, and run apachectl configtest first to catch configuration problems.
Where no fix is out yet, decide whether you need HTTP/2
Apache's advisory has no workaround. As this site's own addition, where there is little reason to use HTTP/2, one option is to remove h2 and h2c from the Protocols setting and run HTTP/1.1 only. This is not a measure named in the advisory and it can affect performance and clients, so test before deciding. You can revert once you can update.
Map what sits in front of Apache
If a load balancer or CDN terminates HTTP/2 and talks HTTP/1.1 to the backend, the backend Apache may not be speaking HTTP/2 at all. Check which hop speaks HTTP/2 in your setup.
Check for anything unusual
No real-world exploitation is reported, but check that nothing odd happened before the update. Look for Apache child processes repeatedly crashing and for unfamiliar files or processes. See how to check whether a website or server was hacked.
Exploitation status
- Apache's advisory does not mention real-world exploitation.
- It is not in the 10 November edition of CISA's KEV catalog.
- The CVE.org record carries no CVSS score. The only severity is Apache's rating (critical).
- The reports came in on 26 October and 3 November, and it was published on 11 November. Whether it was exploited before publication could not be confirmed from public information.
- Red Hat says published research demonstrated a credible attack against servers with HTTP/2 enabled in the default configuration (this is not a report of real-world exploitation).
- No public information on the scale of real-world attacks or on any actors could be confirmed.
Sources
- Apache HTTP Server Project — Apache HTTP Server 2.4 vulnerabilities (the three fixes in 2.4.71, affected versions, report and fix dates)
- CVE.org — CVE-2026-119618 (published 11 November 2026; CWE-362, severity critical, no CVSS)
- Debian — Debian Security Tracker CVE-2026-119618 (fixed versions for bookworm and trixie)
- Ubuntu — CVE-2026-119618 (needs evaluation, priority High)
- Red Hat — CVE-2026-119618 (RHEL 9 and 10 affected, Important)
- CISA KEV — Known Exploited Vulnerabilities Catalog (not listed in the 10 November edition of the catalog)
Turning off HTTP/2 is listed here by this site as a general measure; it is not a workaround stated in Apache's advisory. Last verified: 13 November 2026.
Read next
- Practice: The vulnerability remediation playbook / Asset inventory checklist
- Deciding: Prioritising with CVSS, EPSS and KEV
- Checking for intrusion: How to check whether a website or server was hacked
- Terms: What is RCE / What is CVSS?