Apache HTTP Server patches critical HTTP/2 remote code execution flaw
Unauthenticated attackers can corrupt heap memory in mod_http2 on 2.4.55 through 2.4.70; Wiz knows of no exploits yet.
A race condition in Apache HTTP Server’s mod_http2 can let an unauthenticated attacker corrupt heap memory and run code as the web server process. Versions 2.4.55 through 2.4.70 and standalone mod_h2 2.0.8 through 2.0.42 are affected. Anthropic’s OSS Scanner and Google Cloud Vulnerability Research found the bug, tracked as CVE-2026-119618. Wiz reports no public exploits or attacks so far and notes HTTP/2 is off by default. The same release also fixes a null-pointer flaw in mod_md and a low-severity overwrite in mod_vhost_alias.
Unconfirmed: Wiz says it knows of no public exploits or attacks, and no official severity score is available.
- Standalone mod_h2 2.0.8 through 2.0.42 is also affected.
- Wiz says 64% of cloud environments have vulnerable resources, about half exposed.
- HTTP/2 is off by default, so exposure depends on configuration.
- The release also fixes CVE-2026-106023 and CVE-2026-109163.
Impact: unauthenticated remote code execution as the web server process
| Product | Affected |
|---|---|
| Apache Software Foundation Apache HTTP Server | 2.4.55 through 2.4.70 |
| Apache Software Foundation mod_h2 | 2.0.8 through 2.0.42 |
- 1.Upgrade to the latest Apache HTTP Server release.
- 2.Disable HTTP/2 until the server can be patched.
- Vendors
- Apache Software Foundation
- Organizations
- WizwatchTowrAnthropicGoogle Cloud
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-119618+1 related CVE | Race condition RCE in Apache HTTP Server mod_http2 | 8.1 group max | <1% | PoC ×8 | |
| CVE-2026-109163 | Stack buffer overflow in Apache HTTP Server mod_vhost_alias 2.4.69 | — | — |
From the original article
2 min read at bleepingcomputer.com
A critical vulnerability in the HTTP/2 module of Apache HTTP Server could be exploited by an unauthenticated attacker to obtain remote code execution (RCE). [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.