Critical Apache HTTP/2 Vulnerability: Identify Exposure And Act

Read the full analysis: Critical Apache HTTP/2 Vulnerability: Identify Exposure And Act on ThorstenMeyerAI.com

The Apache HTTP Server project released version 2.4.71 on Nov. 11 to fix CVE-2026-119618, a critical flaw in the mod_http2 module that Apache says can lead to remote code execution. The issue affects specified Apache and standalone mod_h2 versions, but exposure depends on whether a server has HTTP/2 enabled; administrators should check their software version and configuration.

Apache describes the vulnerability as a concurrent execution and synchronization flaw in the assign_headers() function of mod_http2. Red Hat says a thread-safety problem can allow one thread to modify memory used by another, corrupting the server’s internal memory. Red Hat states that a remote attacker able to reach an affected server could execute commands without authentication. Apache rates the issue critical and says it can lead to remote code execution. Red Hat assigns it a CVSS 3.1 score of 9.8 out of 10; the National Vulnerability Database had not published its own score as of Nov. 12.

Apache lists HTTP Server versions 2.4.55 through 2.4.70 as affected, with 2.4.71 as the fixed upstream release. The standalone mod_h2 project lists versions 2.0.8 through 2.0.42 as affected. Red Hat says servers with HTTP/2 enabled through the Protocols directive are affected; servers serving only HTTP/1.1 are not. Administrators should verify actual configuration rather than assume HTTP/2 is active or inactive based on defaults.

Vendor patch status varies. Red Hat shipped fixes on Nov. 11, including packages for RHEL 9 and 10; it lists RHEL 8 and earlier as not affected. Red Hat rates the issue Important for RHEL 9 and 10, citing allocator design that increases exploitation complexity, and Critical overall. On Nov. 12, Debian listed bookworm and trixie as vulnerable and said fixed package 2.4.71-1 was available only in unstable, sid. The source report said it had found no Ubuntu or SUSE advisory at that time; that does not establish whether those distributions are affected or what their current patch status is.

Why HTTP/2 Configuration Matters

The flaw matters because it could turn a reachable web server into a route for unauthenticated command execution, according to Red Hat. That risk is not uniform across every Apache installation: the reported exposure is tied to affected versions and an enabled HTTP/2 protocol. Organizations using Apache for public-facing sites should identify versions and configurations, then apply the relevant vendor fix rather than relying only on an upstream version check.

Cloud exposure figures cited by Wiz indicate that the issue may warrant broad triage, but they are not a count of confirmed exploitable systems. Wiz said 64% of cloud environments in its data had resources vulnerable to the CVE and 51% had publicly exposed instances; it also cautioned that its figures did not account for configuration. Those numbers describe Wiz’s customer data, not all cloud environments or the number of servers that attackers can exploit.

Reports and Patch Timeline

Apache credited the discovery to Anthropic’s OSS Scanner and two researchers from Google Cloud Vulnerability Research. According to Apache, Anthropic’s report arrived on Oct. 26, followed by the Google researchers’ report on Nov. 3. The CVE record says the identifier was reserved on Oct. 30. Apache issued the fix on Nov. 11, 16 days after the first report.

The disclosure record does not settle the question of exploitation. Wiz wrote on Nov. 11 that it had seen no reports of exploitation in the wild and that no exploit was available at publication. CISA’s Known Exploited Vulnerabilities catalog did not list the CVE when checked on Nov. 12, but the catalog version cited had been released before the vulnerability became public. Red Hat, in contrast, said public research had demonstrated a reliable exploit against a default-configured server with mod_http2 enabled. These statements describe different evidence and should not be treated as a definitive account of attacks.

““can lead to RCE””

— Apache HTTP Server project

Exploit Activity and Vendor Status

Whether attackers are exploiting the flaw remains unconfirmed in the cited material. Wiz reported no known in-the-wild exploitation, while Red Hat said public research had demonstrated a reliable exploit. The source report found no public exploit code linked from the advisories, and Red Hat did not identify the research behind its statement. CISA’s absence from the catalog on Nov. 12 is not conclusive because the cited catalog version predated public disclosure.

Patch status also differs by distribution and product. The reported Debian status was limited to a check on Nov. 12, and the source found no published Ubuntu or SUSE advisory then. Red Hat also listed JBoss Core Services and Red Hat Hardened Images as affected. Administrators should consult current vendor notices for their exact product and package; the available information does not establish the status of every downstream build or deployment.

Patch Checks for Apache Administrators

Administrators should inventory Apache and standalone mod_h2 versions, check whether HTTP/2 is enabled, and apply Apache 2.4.71 or the appropriate fixed package from their operating-system vendor. Teams should review vendor advisories for the specific distributions, containers, and managed products they use, including products Red Hat listed as affected. If an immediate patch is unavailable, consult the vendor’s current mitigation guidance rather than assuming that disabling HTTP/2 is necessary or sufficient.

Further vendor advisories, updated vulnerability records, and evidence about exploitation may clarify the remaining questions. The source material does not give a deadline for additional updates or establish when all distributions will publish fixes. Until those details are available, the practical priority is to identify exposed configurations and confirm that applicable patches have been installed.

Key Questions

Which Apache versions are affected?

Apache lists HTTP Server 2.4.55 through 2.4.70 and standalone mod_h2 versions 2.0.8 through 2.0.42 as affected. Apache HTTP Server 2.4.71 is the fixed upstream release. Distribution packages can have separate versioning, so check the relevant vendor advisory.

Does the flaw affect servers that use only HTTP/1.1?

Red Hat says servers serving only HTTP/1.1 are not affected. The reported issue applies when HTTP/2 is enabled, including through the Apache Protocols directive. Check the active server configuration.

Is CVE-2026-119618 being exploited?

The available reports do not confirm in-the-wild attacks. Wiz said it had no reports of exploitation, while Red Hat said public research had demonstrated a reliable exploit. CISA’s catalog did not list the CVE on Nov. 12, but the cited catalog version predated disclosure.

What should administrators do now?

Identify affected Apache or mod_h2 versions, determine whether HTTP/2 is enabled, and install Apache 2.4.71 or the applicable fixed package supplied by the vendor. Check current advisories for the exact operating system and product in use.

Source: ThorstenMeyerAI.com