Short answer

CVE-2026-119618 is a critical flaw in mod_http2, the module that serves HTTP/2 in Apache HTTP Server 2.4.55 to 2.4.70. A race condition in how it assigns headers can corrupt memory and, according to Apache, lead to remote code execution without a login. Upgrade to Apache 2.4.71 or your Linux distribution's patched package now. If you cannot patch today, turn HTTP/2 off until you can.

  • Critical - Apache severity rating for CVE-2026-119618
  • 2.4.71 - the first fixed release, out on 11 November 2026
  • 16 - affected 2.4.x releases, from 2.4.55 to 2.4.70
  • 0 - logins needed to send the requests that trigger it

Apache HTTP Server still runs a large share of the web, including most traditional PHP hosting. On 11 November 2026 the Apache team released 2.4.71, which fixes eight vulnerabilities. One of them, CVE-2026-119618, is rated critical: it sits in the HTTP/2 module that most modern Apache setups have switched on, and Apache says it can lead to remote code execution. This guide explains what the flaw is, how to tell whether your servers are exposed, and what to do in the next few days.

What CVE-2026-119618 is, in plain English

HTTP/2 lets a browser send many requests over one connection at the same time. Apache's mod\_http2 handles those parallel streams with several worker threads. In the affected versions, a function called assign\_headers() touches shared data without the locking it needs. When two threads hit it at once, the server's memory (the heap) can be corrupted.

Memory corruption in a web server is serious because an attacker controls the input. Apache's advisory describes the result as heap corruption that can lead to remote code execution: someone on the internet could run their own code on your server with the web server's permissions, without logging in. That means access to your site files, configuration secrets such as database passwords, and a foothold inside your network.

Race conditions are usually harder to exploit reliably than simple bugs, and at the time of writing there is no public exploit and no report of attacks in the wild. That window rarely stays open for long once a fix is published, because attackers can study the patch.

Who is affected

SoftwareAffectedFixedApache HTTP Server2.4.55 to 2.4.702.4.71Standalone mod_h2 module (GitHub)2.0.8 to 2.0.42Later releases of mod_h2Linux distribution packages (Ubuntu, Debian, Red Hat, AlmaLinux and others)Depends on the backportCheck your vendor's CVE page

You are exposed if all three of these are true:

  • You run an affected Apache version.
  • mod_http2 is loaded. Many distributions and control panels enable it by default.
  • HTTP/2 is turned on through the Protocols directive, which normally lists h2 or h2c.

If Apache sits behind a load balancer or CDN, check how the two connect. The CDN can talk HTTP/2 to visitors and plain HTTP/1.1 to your origin, in which case the origin is not reachable this way. Many setups use HTTP/2 all the way through, though, so confirm it rather than assume.

How to check your servers

Run these on each server. The command name may be apache2ctl on Debian and Ubuntu or httpd on Red Hat-based systems.

# 1. Which version is running? apachectl -v # 2. Is mod_http2 loaded? apachectl -M 2>/dev/null | grep -i http2 # 3. Is HTTP/2 switched on anywhere in the configuration? grep -Rni "^\s*Protocols" /etc/apache2 /etc/httpd 2>/dev/null # 4. From outside: does the site answer over HTTP/2? curl -sI --http2 https://example.com -o /dev/null -w "%{http_version}\n"

A distribution package can show an older version number and still contain the fix, because vendors backport patches. If apachectl -v shows 2.4.55 to 2.4.70, look up CVE-2026-119618 on your vendor's security tracker before you decide whether you are exposed.

What to do now

  1. Patch. Install Apache 2.4.71, or your distribution's updated package once it is out, and restart Apache. A graceful reload does not always replace the loaded module, so do a full restart.
  2. If you cannot patch today, switch HTTP/2 off. Change the Protocols line to HTTP/1.1 only (see below), or unload mod_http2, then restart. Sites keep working; browsers simply fall back to HTTP/1.1, which is a little slower on pages with many assets.
  3. Check managed hosting and appliances. Ask your host, control panel vendor (cPanel, Plesk and others) or appliance vendor whether they ship an affected Apache and when their update lands.
  4. Watch for crashes. Repeated Apache child process crashes or segmentation faults in the error log after this date deserve a closer look. 
# Temporary workaround until you can upgrade: HTTP/1.1 only Protocols http/1.1

Remember to undo the workaround

Once you are on 2.4.71 or a patched package, put h2 back in the Protocols line so you keep the speed benefit of HTTP/2.

The other fixes in Apache 2.4.71

The same release fixes seven more flaws. None is rated critical, but they are another reason to upgrade rather than rely on the HTTP/2 workaround alone.

CVEApache ratingAreaCVE-2026-106023Importantmod_md (automatic certificates): a crash in request handlingCVE-2026-57941Moderatemod_http2: a second memory safety flawCVE-2026-42528Moderatemod_dav: shared lock overflowCVE-2026-93546Moderatemod_dav_fs: namespace overflowCVE-2026-63292Moderatemod_vhost_alias: stack overflowCVE-2026-59685ModerateDirectory handling on case-insensitive file systemsCVE-2026-109163Lowmod_vhost_alias: one-byte overwrite left after the CVE-2026-63292 fix

Note that turning HTTP/2 off also blocks CVE-2026-57941, but does nothing for the others.

Where the details come from

This guide is based on Apache's list of fixed vulnerabilities in 2.4.x, the NVD entry for CVE-2026-119618 and the oss-security announcement. Apache credits the discovery to Anthropic's OSS scanner and to Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research. NVD had not published a CVSS score when we wrote this, so we use Apache's own critical rating.

Are we covered?

  • Which of our servers run Apache 2.4.55 to 2.4.70, including hosting accounts and appliances?
  • On which of them is HTTP/2 switched on?
  • When will every server be on 2.4.71 or a patched distribution package?
  • Where we cannot patch this week, have we switched HTTP/2 off, and who will turn it back on afterwards?

Server security

Need help patching your Apache servers?

We can check which of your servers are exposed, apply the update or workaround safely, and review the rest of your web server setup.

Book a free 30-minute call

Originally published at phpscientist.com.