Apache fixes a flaw that lets attackers take over HTTP/2 servers without logging in

The Apache HTTP Server project released version 2.4.71 on 11 November with a fix for a critical bug in mod_http2, the module that handles HTTP/2 connections. According to the Apache advisory, the flaw, tracked as CVE-2026-119618, can lead to remote code execution and affects every release from 2.4.55 through 2.4.70. An attacker who can reach the server does not need a password or an account to exploit it.

What is wrong in mod_http2

HTTP/2 lets a browser send many requests at once over one connection, and mod_http2 handles them in several threads. Red Hat explains that the bug is a race in the assign_headers() function: a worker thread can write into memory that belongs to the connection thread through a shared allocator that has no lock. This corrupts the server's memory, and an attacker can use the corruption to run their own commands and take over the server process.

Red Hat says public research "has demonstrated a reliable exploit" against a server in its default setup with mod_http2 on, but does not name that research. The Hacker News reports that security company Wiz said on the same day that no exploit was available and no attacks had been seen. Either way, the details are now public, and admins should not wait for a working exploit to appear.

The bug was reported to Apache on 26 October by Anthropic's OSS Scanner, a free service that checks open source projects with the company's AI models. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research found it independently and reported it on 3 November. Version 2.4.71 also fixes a crash in mod_md, rated important, and a one-byte stack overwrite in mod_vhost_alias, rated low.

Who already has a fix

Linux distributions ship their own Apache builds with their own version numbers, so the right package depends on the system. Status as of 12 November:

Standalone builds of the module, published on GitHub as mod_h2, are affected from 2.0.8 through 2.0.42. That repository has been archived since June and has no fixed release. In May Apache fixed a different HTTP/2 bug, CVE-2026-23918, in 2.4.67, so servers updated then are still exposed to this one. Last month NGINX patched similar flaws that also allowed code execution without a login.

How to check your server

• Run apachectl -v to see the version and apachectl -M | grep http2 to see whether mod_http2 is loaded.
• Search the configuration for the Protocols directive, both server-wide and in every virtual host. If you see h2 or h2c, the server speaks HTTP/2.
• Install the update from your distribution as soon as it is out, or move to 2.4.71 if you build Apache yourself.
• If you cannot update yet, Wiz suggests leaving only Protocols http/1.1. Sites will work a little slower, but the vulnerable code will not run.