Apache HTTP Server 2.4.71 fixes critical mod_http2 RCE

Original title: Apache Patches Critical HTTP Server RCE Found by Anthropic, Google

SecurityWeekby Eduard KovacsNov 12, 2026 · 15:38 UTC (1d ago)2 min read1

Part of a story covered by 14 sourcesApache 2.4.71 fixes critical mod_http2 race; exploit claims conflictMerged summary & timeline

AI summary · x-ai/grok-4.7Summaries by Vani AI

Only HTTP/2-enabled servers from 2.4.55 through 2.4.70 are affected; HTTP/1.1-only servers are not.

Apache patched CVE-2026-119618, a critical race condition in mod_http2 that can corrupt memory and allow unauthenticated remote code execution. It affects Apache HTTP Server 2.4.55 through 2.4.70 and was fixed in 2.4.71 on November 11. Anthropic's OSS Scanner and Google Cloud Vulnerability Research reported it independently. Red Hat scored it 9.8. Wiz reported no in-the-wild exploitation when its November 11 blog appeared.

Unconfirmed: Sources differ on whether a public exploit achieves code execution; no attacks are reported.

Key facts

Red Hat says public research showed a reliable exploit against mod_http2.
A GitHub proof of concept shows crashes, not remote code execution.
Wiz said 64% of sampled cloud environments ran affected versions.
Version 2.4.71 also fixes CVE-2026-106023 and CVE-2026-109163.

Security assessment · AI, from the articlePublic proof of concept

Impact: Unauthenticated remote code execution controlling the server process

Product	Affected	Fixed in
Apache HTTP Server	2.4.55 through 2.4.70	2.4.71

What to do

1.Install Apache HTTP Server 2.4.71 or vendor-supplied packages.
2.Disable HTTP/2 temporarily if the update cannot be deployed immediately.

Analyze CVE-2026-119618 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2026-119618 CVE-2026-106023 CVE-2026-109163

ATT&CK: T1190 Exploit Public-Facing Application

Tags: apache http-server mod-http2 rce http2

Vendors: Apache
Products: Apache HTTP Server
Organizations: Anthropic Google Red Hat Wiz

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-119618 +1 related CVE CVE-2026-106023	Race condition RCE in Apache HTTP Server mod_http2	8.1 group max	<1%	PoC ×9	2d ago
CVE-2026-109163	Stack buffer overflow in Apache HTTP Server mod_vhost_alias 2.4.69	—	—		2d ago

From the original article

2 min read at securityweek.com

The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled. The post Apache Patches Critical HTTP Server RCE Found by Anthropic, Google appeared first on SecurityWeek.

SecurityWeek

By Eduard Kovacs · securityweek.com

Read the full article at SecurityWeek

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.