CVE-2026-119618 in Apache mod_http2 allows unauthenticated remote code execution
Original title: Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
Red Hat rates it 9.8 and claims a reliable public exploit, while Wiz reports no exploit and no attacks in the wild.
A flaw in Apache HTTP Server’s mod_http2 can let a remote attacker who reaches an HTTP/2-enabled server run code without authentication and take full control of the server process, Red Hat says. The Apache project fixed it in 2.4.71, which also addresses an important mod_md crash and a low-severity one-byte overwrite in mod_vhost_alias. Standalone mod_h2 builds have no fixed release, and that repository has been read-only since it was archived on June 9. Anthropic’s OSS Scanner and Google Cloud Vulnerability Research reported the flaw.
Unconfirmed: Red Hat says unnamed public research demonstrated a reliable exploit, while Wiz says no exploit is available and no in-the-wild exploitation has been reported.
- Affected Apache HTTP Server releases are 2.4.55 through 2.4.70; 2.4.71 is the fix.
- Standalone mod_h2 2.0.8 through 2.0.42 has no fix; the repo was archived June 9.
- Only servers with HTTP/2 enabled through the Protocols directive are affected.
- Red Hat Enterprise Linux 8 and earlier do not contain the vulnerable code.
- Anthropic’s OSS Scanner reported it on October 26; Google researchers reported it last week.
Impact: Unauthenticated remote code execution and control of the server process.
| Product | Affected | Fixed in |
|---|---|---|
| Apache HTTP Server | 2.4.55 through 2.4.70 | 2.4.71 |
| Apache mod_h2 | 2.0.8 through 2.0.42 | — |
- 1.Upgrade Apache HTTP Server project releases to 2.4.71.
- 2.If you cannot update, remove h2 and h2c from Protocols and leave http/1.1.
- 3.Check the server-wide Protocols setting and every virtual host.
- CVEs
- CVE-2026-119618
- Organizations
- WizAnthropicGoogle Cloud Vulnerability Research
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119618 | Race condition RCE in Apache HTTP Server mod_http2 | 8.1 | <1% | PoC ×9 |
From the original article
3 min read at thehackernews.com
A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2. 4.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.