CVE-2026-119618: A Critical Apache HTTP/2 Flaw Can Lead to Remote Code Execution

Key takeaways for CVE-2026-119618

• CVE-2026-119618 affects Apache HTTP Server versions 2.4.55 through 2.4.70 and standalone mod_h2 releases 2.0.8 through 2.0.42. Apache fixed the issue in version 2.4.71, released November 11.
• The flaw is a race condition in mod_http2’s assign_headers() function. It can corrupt heap memory and lead to remote code execution with the privileges of the Apache process.
• Only servers with HTTP/2 enabled are affected. Apache rates the issue Critical. Red Hat assigns a CVSS 3.1 score of 9.8, while Bitsight’s threat intelligence report gives it a DVE score of 8.23/10.
• Red Hat says public research has demonstrated a reliable exploit. Third-party reporting says a public GitHub repository contains crash-reproduction tooling, but that has not been verified as a working RCE exploit. 
• Upgrade to Apache HTTP Server 2.4.71 or a vendor package containing the fix. If you cannot patch immediately, temporarily disable HTTP/2 and serve HTTP/1.1 only.

A race condition in Apache HTTP Server’s mod_http2 module can corrupt memory and lead to remote code execution. Apache disclosed CVE-2026-119618 on November 11 and fixed it in Apache HTTP Server 2.4.71. The issue affects versions 2.4.55 through 2.4.70, and only servers with HTTP/2 enabled are exposed.

What happened?

Apache’s security advisory identifies CVE-2026-119618 as a critical heap-corruption and remote-code-execution vulnerability in mod_http2. Versions 2.4.55 through 2.4.70 are affected, and Apache lists 2.4.71 as the fixed release. Standalone mod_h2 releases from 2.0.8 through 2.0.42 are also affected. Anthropic’s OSS Scanner reported the issue to Apache on October 26. Apache released the fix on November 11. Red Hat rates the flaw Critical and assigns a CVSS 3.1 score of 9.8. Its advisory says public research has demonstrated a reliable exploit against a default-configured server with mod_http2 enabled. Reports state crash-reproduction tooling has appeared publicly, but that doesn’t by itself demonstrate a working remote-code-execution exploit.

How CVE-2026-119618 works

Apache mod_http2 processes HTTP/2 requests concurrently across multiple threads. CVE-2026-119618 is a thread-safety flaw in the assign_headers() function. Red Hat explains that a worker thread can write to memory owned by the connection thread through a shared, lock-free allocator. That race can corrupt the server’s heap and potentially allow an attacker to execute commands with the privileges of the Apache process. An attacker doesn’t need to authenticate, but must be able to reach a vulnerable server using HTTP/2. Red Hat says servers configured to serve only HTTP/1.1 are not affected. 

Understanding severity and exposure

• Apache classifies CVE-2026-119618 as Critical. 
• Red Hat assigns a CVSS 3.1 score of 9.8, with a network attack vector, low complexity, no privileges required, and no user interaction. 
• Bitsight assigns it a DVE score of 8.23/10. 
• Red Hat rates the issue Important rather than Critical for RHEL 9 and RHEL 10 because those packages use a separate allocator for each HTTP/2 stream, which substantially increases exploitation complexity. 
• Red Hat says RHEL 8 and earlier are not affected. 
• Check your distribution’s advisory and package status instead of relying only on the upstream Apache version number.

Where things stand: Patching and mitigations

Apache HTTP Server 2.4.71 fixes CVE-2026-119618. Upgrade affected servers to 2.4.71 or to a vendor package that includes the fix, then restart Apache so the patched code is running. If you use a standalone mod_h2 build, check the maintainer or vendor guidance for a fixed package. If you cannot patch immediately, temporarily disable HTTP/2. Check the global configuration and virtual-host-specific directives, then restart Apache and confirm that HTTP/2 is no longer offered. This is a temporary mitigation; apply the vendor fix as soon as it is available for your environment. Network segmentation and access controls can reduce which systems can reach the web server, but they do not fix the underlying flaw. Prioritize patching internet-facing instances and internal servers that accept HTTP/2 from untrusted or lower-trust networks.

How Bitsight can help

• Bitsight External Attack Surface Management helps security teams identify internet-facing web infrastructure and assess exposure across their environments and vendor ecosystems. 
• Bitsight’s proprietary Dynamic Vulnerability Exploit (DVE) predicts the likelihood of active threat actor targeting for vulnerability within a 90 day period .
• Bitsight Beacon is a supply chain exposure management tool that can help customers bridge the gap between threat intelligence and third party risk. 

Wrapping up

CVE-2026-119618 is a critical race condition in Apache’s HTTP/2 module that can lead to remote code execution. Apache fixed it in version 2.4.71, and only servers with HTTP/2 enabled are affected. Red Hat says public research has demonstrated a reliable exploit. Teams should patch promptly and temporarily disable HTTP/2 on systems that cannot be updated right away.

CVE-2026-119618: What to do next

• Inventory Apache HTTP Server deployments and identify versions 2.4.55 through 2.4.70, plus affected standalone mod_h2 builds.
• Confirm whether mod_http2 is loaded and whether h2 or h2c is enabled in global or virtual-host configuration.
• Upgrade to Apache HTTP Server 2.4.71 or a vendor package containing the fix, then restart the service.
• If patching is delayed, temporarily disable HTTP/2 and serve HTTP/1.1 only.
• Check vendor advisories for distribution-specific package status and backported fixes.
• Review Apache error logs and process activity for unexplained crashes or unexpected child processes; investigate anomalies as potential compromise.