Critical Apache HTTP/2 RCE: CVE-2026-119618 fixed in 2.4.71
Apache shipped 2.4.71 on Wednesday with a fix for CVE-2026-119618, a race condition in mod_http2 that lets an unauthenticated client corrupt heap memory and execute code with the web server’s privileges. Releases 2.4.55 through 2.4.70 are in scope whenever HTTP/2 is enabled. There are no confirmed in-the-wild exploits and no CISA KEV entry yet. I’d patch this week anyway.
The flaw is CWE-362, improper synchronization of a shared resource, in the module’s assign_headers() function. Red Hat’s writeup captures the mechanics: HTTP/2 stream worker threads and the connection thread share a lock-free allocator, and a worker can end up writing into memory the connection thread owns. Land the wrong interleaving under concurrent requests and heap corruption becomes arbitrary code execution. No credentials, no user interaction, just the ability to speak HTTP/2 to the server.
Severity is a small saga: Apache rates it critical, Red Hat scores 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and NVD still has no score.
Anthropic’s OSS Scanner, the free service that scans open source projects with their AI models, reported the bug October 26. Google Cloud Vulnerability Research’s Anthony Weems and Simon Scannell reported it separately on November 3. Commit 824beab landed in the tree and 2.4.71 shipped a week later. An AI-scanner-to-patch pipeline measured in weeks is the part worth staring at.
Exploit status as of Friday: no CISA KEV entry, no reported exploitation in the wild. But Red Hat’s CVE page states that public research has demonstrated a reliable exploit against a default-configured server with mod_http2 enabled. A working exploit in lab form plus exploit guidance in public advisories ends the wait-and-see phase.
Wiz’s fleet telemetry says 64% of cloud environments run something in the affected version range and 51% have publicly exposed instances. That count is version-based and config-blind: the flaw requires h2 or h2c enabled through the Protocols directive. If your load balancer terminates HTTP/2 and your origin speaks HTTP/1.1, mod_http2 never engages and a version match alone doesn’t indict you. Treat Wiz’s numbers as triage input, not a verdict.
What to do, in order. First, upgrade to 2.4.71 or your distro’s patched build. Red Hat shipped errata for RHEL 9 and 10 this week, rates those builds Important rather than Critical because their packages give each stream a separate allocator, and rates RHEL 8 and earlier not affected. Upstream builds get no such discount: Docker images, source compiles, anything you assembled yourself is the full 9.8 story. Second, know that the standalone mod_h2 module from GitHub is a dead end here: builds 2.0.8 through 2.0.42 are affected, no fixed release exists, and the repository has been archived and read-only since June. Distro packages or nothing. Third, if you can’t patch today, there’s no official workaround in Apache’s advisory; the interim control is removing h2 and h2c from your Protocols directives so servers run Protocols http/1.1, in the main config and every virtual host. HTTP/1.1-only servers are not vulnerable, and clients renegotiate without ceremony.
Zoom out and this is the fourth mod_http2 CVE in the 2.4 line this year: May’s 2.4.67, June’s 2.4.68, October’s 2.4.69, and now a critical RCE. If HTTP/2 doesn’t terminate on your origin, disabling h2 there permanently removes you from a recurring CVE class that has produced four patches in seven months. Behind a modern edge, origin HTTP/2 rarely earns its maintenance rent.
Questions or war stories: info@stackref.com.
This post was created with a Hermes AI agent (hermesagent.ai) from a weekly news gathering workflow, then reviewed and approved by Keith before publication.
