Patch Apache httpd now: CVE-2026-119618 is a critical HTTP/2 remote code execution bug, fixed in 2.4.71

The Apache HTTP Server project rates CVE-2026-119618 critical: a thread-safety bug in mod_http2 that “can lead to RCE”. It affects httpd 2.4.55 through 2.4.70, and the standalone mod_h2 module from 2.0.8 through 2.0.42. The fix shipped in httpd 2.4.71 on 11 November.

What the bug is

HTTP/2 lets one client send many requests at once over a single connection, and mod_http2 handles them on worker threads. Red Hat’s bulletin explains the flaw: a worker thread can write into memory owned by the connection thread through a shared allocator that has no lock. That corrupts the server’s memory, and a crafted sequence of concurrent HTTP/2 requests can turn it into code execution in the httpd process. No login is needed; the attacker only has to reach the HTTP/2 port.

Red Hat’s CVE page says public research has shown a reliable exploit against a default-configured server with mod_http2 enabled. The upstream fix, commit 824beab, is a one-line change in assign_headers().

Apache credits two independent finders: Anthropic’s OSS Scanner, which reported it on 26 October, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research, who reported it on 3 November. We covered the scanner program earlier.

Who is affected

Only servers with HTTP/2 turned on: h2 or h2c in a Protocols directive, with mod_http2 loaded. Servers that serve only HTTP/1.1 are not affected. A quick check from Red Hat’s bulletin:

curl -kI --http2 https://your-host/
# "HTTP/2 200" on the first line means HTTP/2 is on
grep -ri "Protocols" /etc/httpd/conf/ /etc/httpd/conf.d/

On Debian and Ubuntu the config lives under /etc/apache2/ instead.

Distro status, checked 13 November:

• Debian. Fixed in 2.4.71 for bookworm and trixie security (DSA-6620-1, DLA-4902-1) and in sid, per the security tracker.
• Ubuntu. Priority High, fixed packages listed for 20.04 through 26.10 on the CVE page, with 20.04 through Ubuntu Pro. Ubuntu notes that newer mod_http2 code was backported, which is why releases such as 22.04, on httpd 2.4.52, get a fix too. Do not rule a server out by its httpd version alone.
• Red Hat. Critical overall, but rated Important on RHEL 9 and 10 because their mod_http2 gives each stream its own allocator. RHEL 8 and earlier are not affected.
• Containers. The official httpd:2.4.71 images, including Alpine, were pushed to Docker Hub on 13 November. Rebuild anything based on older tags.

If you built the standalone mod_h2 from GitHub, note that its repository has been archived since June and has no release after 2.0.42. Move to the module bundled with httpd 2.4.71.

If you cannot patch today

Remove h2 and h2c from every Protocols line so it reads Protocols http/1.1, then restart httpd. Browsers and API clients fall back to HTTP/1.1. Red Hat warns of slower page loads and more bandwidth without HTTP/2 multiplexing, and says the eventual fix does not require turning HTTP/2 off.

Why this matters

Apache httpd sits in front of a lot of production traffic, and this is an unauthenticated network bug with a reliable exploit, according to Red Hat. Fixed packages and container images are already out, so the gap between disclosure and attack is the time you take to roll them. It is also the second server-side patch-now note this week, after the MongoDB pre-auth crash, and one where an AI scanner and a human research team found the same bug a week apart.