Apache httpd 2.4.71 Fixes a Critical HTTP/2 Flaw (CVE-2026-119618); Whether It Is Exploited Is Disputed

The Apache HTTP Server project released version 2.4.71 on 11 November to fix a flaw it rates Critical. CVE-2026-119618 is a synchronisation bug in mod_http2’s assign_headers() function that can corrupt the heap and lead to remote code execution. It affects httpd 2.4.55 through 2.4.70, but only where HTTP/2 is switched on. Anthropic’s OSS Scanner and Google’s Cloud Vulnerability Research team found it independently.

CVE	CVE-2026-119618 · mod_http2 · Apache: Critical
Affecté	httpd 2.4.55–2.4.70 with h2/h2c; mod_h2 2.0.8–2.0.42
Réparer	httpd 2.4.71
Workaround	Remove h2/h2c from Protocols (Wiz)

Ce qui s'est passé

[Confirmed] Apache rates CVE-2026-119618 Critique: improper synchronisation of a shared resource in mod_http2’s assign_headers() can cause heap corruption and remote code execution. It affects httpd 2.4.55 to 2.4.70 and the standalone mod_h2 2.0.8 to 2.0.42, and is fixed in 2.4.71, released 11 November. Anthropic’s OSS Scanner reported it on 26 October and Google Cloud Vulnerability Research (Anthony Weems, Simon Scannell) on 3 November. The same release fixes CVE-2026-106023 (Important: mod_md NULL dereference crashes a child process, 2.4.30–2.4.70) and CVE-2026-109163 (Low: mod_vhost_alias one-byte stack overwrite). (Apache)

[Reported] Red Hat scores it 9.8 but rates it “Important” on RHEL 9 and 10 because of per-stream memory allocators. [Unknown] Whether it is exploited: Red Hat says public research has shown a reliable exploit, without citing it; Wiz says no exploit is available and none has been seen in the wild. (Les actualités des hackers)

Qui est concerné ?

[Reported] Only servers in the version range with HTTP/2 enabled through the Protocols directive. [MAG212 analysis] That still covers many school, SMB and hosting servers, and appliances that bundle httpd, whose vendor patches will lag upstream.

Exposure check

OS: Linux (Debian/Ubuntu or RHEL family) · Shell: bash · Privileges: user (root to read some configs) · READ-ONLY

# Version (apache2ctl on Debian/Ubuntu, apachectl on RHEL)
apachectl -v 2>/dev/null || apache2ctl -v
# Is mod_http2 loaded?
(apachectl -M 2>/dev/null || apache2ctl -M) | grep -i http2
# Where is HTTP/2 switched on?
grep -RniE '^\s*Protocols\s' /etc/apache2 /etc/httpd 2>/dev/null

Exposed only if all three match: a version in range, http2_module listed, and a Protocols line containing h2 or h2c. Distribution packages may carry a backported fix under an older number: check your vendor’s advisory. Commands not tested by MAG212 CYBER.

Remediate

1. Update to 2.4.71 or your distribution’s fixed package.
2. Until then, remove h2 et h2c from Protocols and reload; clients fall back to HTTP/1.1. There is no official workaround; this is Wiz’s suggestion. (Les actualités des hackers)
3. Ask appliance vendors whether their bundled httpd is affected.

Vérifier la récupération : apachectl -v shows the fixed build, or an HTTP/2 test (for example curl -sI --http2 https://your.site) shows HTTP/1.1. Prevention [MAG212 analysis]: keep a list of every server that bundles a web server, including appliances, so the next httpd bug takes minutes to scope.

What else is in 2.4.71

[Confirmed] The same release fixes two more flaws: CVE-2026-106023, rated Important, a NULL pointer dereference in mod_md that crashes a child process on 2.4.30 through 2.4.70; and CVE-2026-109163, rated Low, a one-byte stack overwrite in mod_vhost_alias that follows up an earlier fix. Sites that use mod_md for automatic Let’s Encrypt certificates have a second reason to update.

[MAG212 analysis] Most organisations don’t run upstream Apache directly; they run their Linux distribution’s package, a control panel’s build or an appliance’s bundled copy. Distributions often backport fixes without changing the version number, so a server reporting 2.4.62 may already be fixed. Check your distribution’s security tracker for CVE-2026-119618 rather than relying on the version string alone.

Pourquoi c'est important

Apache httpd runs on a huge share of the web, including school, small-business and hosting servers and many appliances that bundle it quietly. An unauthenticated remote code execution flaw in the HTTP/2 path is the kind of bug exploit developers race to weaponise, and the two big voices disagree: Red Hat says a reliable exploit has been shown publicly, Wiz says none is available. That uncertainty is a reason to move, not to wait.

The bottom line

Check whether each server is in the version range, loads mod_http2 and enables h2 or h2c. If all three are true, update to 2.4.71 or your distribution’s fixed package; until you can, remove h2 and h2c from Protocols, and ask appliance vendors when their bundled httpd will be fixed.

How we label evidence: [Confirmed] comes from a primary source such as a vendor or CISA; [Reported] from a secondary outlet; [Claimed] from an attacker or an unverified party; [MAG212 analysis] is our judgement; [Unknown] means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.

---

This story is part of MAG212 CYBER Daily, 12 November 2026, with the day’s other verified stories, the Defender’s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER. Par El Mostafa Ouchen.