Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

Apache HTTP Server 2.4.71 fixes critical HTTP/2 remote code execution

Original title: Apache Patches Critical HTTP/2 Flaw Allowing Remote Code Execution on Web Servers

Cyber Security Newsby Abinaya ()3 min read
Read at cybersecuritynews.com
Part of a story covered by 14 sourcesApache 2.4.71 fixes critical mod_http2 race; exploit claims conflictMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

CVE-2026-119618 in mod_http2 affects 2.4.55 through 2.4.70; the CVE entry is still reserved and no workaround is listed.

Apache fixed a critical concurrency bug in assign_headers() in mod_http2 that can corrupt the heap and allow remote code execution. Versions 2.4.55 through 2.4.70 are affected, and standalone mod_h2 2.0.8 through 2.0.42 should also be checked. The November 11 release, 2.4.71, also fixes an important NULL-pointer crash in mod_md and a low one-byte overflow in mod_vhost_alias. Anthropic’s OSS Scanner and Google Cloud researchers reported the HTTP/2 flaw; exploitation is not described.

Unconfirmed: The CVE entry is reserved, with no public CVSS score or detailed write-up yet.

Key facts
  • Anthropic’s OSS Scanner reported the flaw on October 26, 2026.
  • Google Cloud researchers independently reported it on November 3.
  • CVE-2026-106023 can crash a mod_md child process on 2.4.30 through 2.4.70.
  • CVE-2026-109163 affects only Apache HTTP Server 2.4.69 and 2.4.70.
  • Linux distributions may ship the fix without changing the version number.
Security assessment · AI, from the article

Impact: remote code execution via HTTP/2 heap corruption

ProductAffectedFixed in
Apache HTTP Server2.4.55 through 2.4.702.4.71
Apache mod_h22.0.8 through 2.0.42—
Apache mod_md2.4.30 through 2.4.702.4.71
Apache mod_vhost_alias2.4.69 and 2.4.702.4.71
What to do
  1. 1.Upgrade public HTTP/2 servers to Apache HTTP Server 2.4.71.
  2. 2.If upgrade is delayed, limit the server to HTTP/1.1 after testing.
  3. 3.Check the distribution advisory before assuming the packaged build is unfixed.
Analyze CVE-2026-119618 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-119618CVE-2026-106023CVE-2026-109163
Tags
apachehttp2mod-http2remote-code-executionweb-server
Vendors
Apache
Products
Apache HTTP Servermod_http2mod_h2mod_mdmod_vhost_alias
Organizations
AnthropicGoogle Cloud Vulnerability Research

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-119618
+1 related CVE
CVE-2026-106023
Race condition RCE in Apache HTTP Server mod_http2
8.1
group max
<1%PoC ×9
CVE-2026-109163
Stack buffer overflow in Apache HTTP Server mod_vhost_alias 2.4.69
——

From the original article

3 min read at cybersecuritynews.com

Apache has fixed a critical bug in its HTTP/2 module that could let a remote attacker run code on a web server. The flaw is tracked as CVE-2026-119618 and affects mod_http2. The fix came on November 11, 2026, in Apache HTTP Server 2.

Cyber Security News

By Abinaya · cybersecuritynews.com

Read the full article at Cyber Security News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.