Critical2026-11-13
CVE-2026-119618 — Apache HTTP Server mod_http2 heap corruption and remote code execution (2.4.55 to 2.4.70 affected, fixed in 2.4.71): explainer and fix
A flaw in Apache HTTP Server's mod_http2 where shared resources are used concurrently without proper synchronization (CWE-362), which can lead to remote code execution (RCE). Apache rates it critical, its highest level, and gives no CVSS score. Versions 2.4.55 to 2.4.70 are affected and 2.4.71 (11 November 2026) fixes it, together with two other issues. No real-world exploitation is reported, but Red Hat says published research showed a credible attack against default-configuration servers with HTTP/2 enabled, and the advisory lists no workaround. This site's view: update any Apache with HTTP/2 enabled to 2.4.71 promptly, and until your distribution ships a fix, check whether you need HTTP/2 at all.