Apache HTTP Server has a critical pre-authentication remote code execution vulnerability in its HTTP/2 module. CVE-2026-119618 scores 9.8 on CVSS, affects versions 2.4.55 through 2.4.70, and was fixed in Apache 2.4.71 — released November 11. A public proof-of-concept landed on GitHub the next day. If you are running Apache with HTTP/2 enabled, your server is likely exposed, and the window to act before active exploitation starts is shrinking.
What the Bug Is
The flaw lives in assign_headers(), a function inside mod_http2 responsible for writing synthesized response headers into a shared APR table. When an HTTP/2 worker thread writes a Content-Length: 0 header, it touches the same in-memory structure the connection thread may be reading — without a lock. That is a classic race condition, and in this case, the collision corrupts the heap.
Heap corruption from a race does not automatically mean code execution — it often just crashes the process. But with enough heap grooming, an attacker can steer the corruption toward overwriting a critical pointer and achieve arbitrary execution under the web server process user (www-data on Debian, apache on RHEL). No authentication required. No user interaction required. Just an HTTP/2 request with a Content-Type header and no Content-Length.
How Exposed Is Your Server?
According to Wiz’s cloud exposure data, 64% of cloud environments contain at least one vulnerable instance, and 51% have a public-facing Apache server in the affected range. Apache still handles roughly a quarter of all active web traffic globally. The exposure is not niche.
The affected range is any Apache HTTP Server from 2.4.55 to 2.4.70 with HTTP/2 enabled. HTTP/2 is enabled by default in many modern Apache configurations. Check whether you are in that range:
# Check Apache version
apache2 -v # Debian / Ubuntu
httpd -v # RHEL / Fedora / Amazon Linux
# Check if HTTP/2 module is loaded
apache2ctl -M | grep http2If your version is below 2.4.71 and http2_module appears in that output, you are vulnerable.
Upgrade Now — But Check Your Distribution First
Apache 2.4.71 is the fix. The upgrade is straightforward if your distribution has packaged it. That is not guaranteed yet, and this is the part most advisories skip over.
Debian 13 “Trixie”: Patched. DSA-6620-1 ships 2.4.71. Run the commands below and you are covered.
# Debian 13 — patched
sudo apt update && sudo apt install --only-upgrade apache2
sudo systemctl restart apache2
# RHEL 9 / 10 — patched
sudo dnf update httpd mod_http2
sudo systemctl restart httpdDebian 12 “Bookworm”: Not yet patched via standard apt as of November 12. CSA Labs documented this distribution patch gap — running apt update alone will not protect you. Watch the Debian security tracker for the Bookworm advisory.
Ubuntu 22.04 / 24.04: No Ubuntu Security Notice published as of November 12. Same situation — package repositories are still behind. Apply the workaround below until your distro ships a fix.
Workaround: Disable HTTP/2 Until Your Distro Patches
If you cannot upgrade immediately because your distribution has not shipped the fixed package yet, disable mod_http2:
# Debian / Ubuntu — disable HTTP/2
sudo a2dismod http2
sudo systemctl restart apache2
# RHEL / Fedora — edit /etc/httpd/conf.d/http2.conf
# Comment out: Protocols h2 http/1.1
sudo systemctl restart httpdDisabling HTTP/2 removes the attack surface entirely. Your server falls back to HTTP/1.1, with a performance cost but zero exposure to CVE-2026-119618 until a proper package update arrives.
Who Found It
This CVE has an unusual discovery story. Anthropic’s OSS Scanner — an AI-powered static analysis tool that audits open-source codebases — filed the initial report on October 26. Google Cloud Vulnerability Research independently confirmed the same vulnerability on November 3. Apache credited both.
An AI tool found a 9.8 RCE in one of the most widely deployed pieces of web infrastructure on the internet before human security researchers did. That is not a fluke — it is a signal of where vulnerability research is heading.
No In-the-Wild Exploitation Yet
As of November 13, there are no confirmed reports of CVE-2026-119618 being exploited in active attacks. A containerized proof-of-concept that reproduces the heap corruption is publicly available on GitHub — it does not hand attackers a working shell, but it lowers the barrier for further weaponization.
The last time Apache shipped a critical pre-auth RCE (CVE-2021-41773 in 2021), active exploitation began within hours of the PoC going public. History does not repeat on a schedule, but it rhymes. Upgrade to 2.4.71, or disable HTTP/2 if your distro is still behind.
