Apache HTTP Server 2.4.55–2.4.70 HTTP/2 flaw can allow RCE

Original title: PSA: Critical Apache HTTP/2 Vulnerability: What WordPress Site Owners Should Know

Wordfenceby Alex ThomasNov 12, 2026 · 14:39 UTC (1d ago)10 min read1

Part of a story covered by 14 sourcesApache 2.4.71 fixes critical mod_http2 race; exploit claims conflictMerged summary & timeline

AI summary · x-ai/grok-4.7Summaries by Vani AI

Apache shipped 2.4.71 on November 11; WordPress and Wordfence updates do not patch the server module.

Apache fixed CVE-2026-119618, a critical flaw in the HTTP/2 module of Apache HTTP Server that can lead to remote code execution. Versions 2.4.55 through 2.4.70 are affected, and 2.4.71 was released on November 11, 2026. Servers that do not offer h2 or h2c through the affected module are not exposed. Wordfence says WordPress, plugin, and firewall updates do not fix Apache, and Wiz reported no known exploitation as of November 11.

Unconfirmed: Red Hat says public research showed a reliable exploit, but the posted public test shows crashes, not command execution.

Key facts

Standalone modh2 releases 2.0.8 through 2.0.42 are also listed as affected.
Red Hat describes unauthenticated remote code execution when HTTP/2 is enabled.
Anthropic’s OSS Scanner reported it on October 26; Google researchers on November 3.
A public test shows child-process crashes on 2.4.70, not command execution.
Vendor backports mean the Apache version number alone may not show patch status.

Security assessment · AI, from the articlePublic proof of concept

Impact: Unauthenticated remote code execution as the web server process

Product	Affected	Fixed in
Apache HTTP Server	2.4.55 through 2.4.70	2.4.71
Apache modh2	standalone releases 2.0.8 through 2.0.42	—

What to do

1.Upgrade Apache HTTP Server to 2.4.71 and restart Apache.
2.Ask hosts whether h2 or h2c is enabled and CVE-2026-119618 is fixed.
3.Check the OS or control-panel vendor advisory; version alone may miss a backport.

Analyze CVE-2026-119618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2026-119618

ATT&CK: T1190 Exploit Public-Facing Application

Tags: apache http2 modhttp2 remote-code-execution wordpress

Vendors: Apache
Products: Apache HTTP Server modhttp2
Organizations: Anthropic Red Hat Wiz

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-119618	Race condition RCE in Apache HTTP Server mod_http2	8.1	<1%	PoC ×9	2d ago

From the original article

10 min read at wordfence.com

Apache has released a fix for a critical vulnerability in the HTTP/2 module of Apache HTTP Server. The issue, CVE-2026-119618, can lead to remote code execution on affected servers. If your WordPress site is hosted on Apache, ask your host whether its Apache server accepts HTTP/2 and whether the fix has been installed.

Wordfence

By Alex Thomas · wordfence.com

Read the full article at Wordfence

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.