{"id":4207,"date":"2026-11-12T07:03:14","date_gmt":"2026-11-12T15:03:14","guid":{"rendered":"https:\/\/cyber.mag212.com\/apache-httpd-2-4-71-cve-2026-119618-mod-http2-critical-rce\/"},"modified":"2026-11-12T07:03:14","modified_gmt":"2026-11-12T15:03:14","slug":"apache-httpd-2-4-71-cve-2026-119618-mod-http2-critical-rce","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/apache-httpd-2-4-71-cve-2026-119618-mod-http2-critical-rce\/","title":{"rendered":"Apache httpd 2.4.71 Fixes a Critical HTTP\/2 Flaw (CVE-2026-119618); Whether It Is Exploited Is Disputed"},"content":{"rendered":"\n

The Apache HTTP Server project released version 2.4.71 on 11 November to fix a flaw it rates Critical. CVE-2026-119618 is a synchronisation bug in mod_http2\u2019s assign_headers() function that can corrupt the heap and lead to remote code execution. It affects httpd 2.4.55 through 2.4.70, but only where HTTP\/2 is switched on. Anthropic\u2019s OSS Scanner and Google\u2019s Cloud Vulnerability Research team found it independently.<\/p>\n\n\n\n

CVE<\/strong><\/td>CVE-2026-119618 \u00b7 mod_http2 \u00b7 Apache: Critical<\/td><\/tr>
Affected<\/strong><\/td>httpd 2.4.55\u20132.4.70 with h2\/h2c; mod_h2 2.0.8\u20132.0.42<\/td><\/tr>
Fix<\/strong><\/td>httpd 2.4.71<\/td><\/tr>
Workaround<\/strong><\/td>Remove h2\/h2c from Protocols (Wiz)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What happened<\/h2>\n\n\n\n

[Confirmed]<\/strong> Apache rates CVE-2026-119618 Critical<\/strong>: improper synchronisation of a shared resource in mod_http2’s assign_headers()<\/code> can cause heap corruption and remote code execution. It affects httpd 2.4.55 to 2.4.70 and the standalone mod_h2 2.0.8 to 2.0.42, and is fixed in 2.4.71, released 11 November<\/strong>. Anthropic’s OSS Scanner reported it on 26 October and Google Cloud Vulnerability Research (Anthony Weems, Simon Scannell) on 3 November. The same release fixes CVE-2026-106023<\/strong> (Important: mod_md NULL dereference crashes a child process, 2.4.30\u20132.4.70) and CVE-2026-109163<\/strong> (Low: mod_vhost_alias one-byte stack overwrite). (Apache<\/a>)<\/p>\n\n\n\n

[Reported]<\/strong> Red Hat scores it 9.8 but rates it “Important” on RHEL 9 and 10 because of per-stream memory allocators. [Unknown]<\/strong> Whether it is exploited: Red Hat says public research has shown a reliable exploit, without citing it; Wiz says no exploit is available and none has been seen in the wild. (The Hacker News<\/a>)<\/p>\n\n\n\n

\"Decision
Figure 6 \u00b7 Am I exposed to CVE-2026-119618?.<\/strong> Three questions decide exposure. Any ‘no’ means this flaw doesn’t apply. Diagram: MAG212 CYBER<\/figcaption><\/figure>\n\n\n\n

Who is affected<\/h2>\n\n\n\n

[Reported]<\/strong> Only servers in the version range with HTTP\/2 enabled<\/strong> through the Protocols<\/code> directive. [MAG212 analysis]<\/strong> That still covers many school, SMB and hosting servers, and appliances that bundle httpd, whose vendor patches will lag upstream.<\/p>\n\n\n\n

Exposure check<\/h3>\n\n\n\n

OS: Linux (Debian\/Ubuntu or RHEL family) \u00b7 Shell: bash \u00b7 Privileges: user (root to read some configs) \u00b7 READ-ONLY<\/em><\/p>\n\n\n\n

# Version (apache2ctl on Debian\/Ubuntu, apachectl on RHEL)\napachectl -v 2>\/dev\/null || apache2ctl -v\n# Is mod_http2 loaded?\n(apachectl -M 2>\/dev\/null || apache2ctl -M) | grep -i http2\n# Where is HTTP\/2 switched on?\ngrep -RniE '^\\s*Protocols\\s' \/etc\/apache2 \/etc\/httpd 2>\/dev\/null<\/code><\/pre>\n\n\n\n
Exposed only if all three match: a version in range, http2_module listed, and a Protocols line containing h2 or h2c. Distribution packages may carry a backported fix under an older number: check your vendor’s advisory. Commands not tested by MAG212 CYBER.<\/strong><\/p>\n\n\n\n
Remediate<\/h2>\n\n\n\n
    \n
  1. Update to 2.4.71<\/strong> or your distribution’s fixed package.<\/li>\n\n\n
  2. Until then<\/strong>, remove h2<\/code> and h2c<\/code> from Protocols and reload; clients fall back to HTTP\/1.1. There is no official workaround; this is Wiz’s suggestion. (The Hacker News<\/a>)<\/li>\n\n\n
  3. Ask appliance vendors<\/strong> whether their bundled httpd is affected.<\/li>\n\n<\/ol>\n\n\n\n
    Verify recovery:<\/strong> apachectl -v<\/code> shows the fixed build, or an HTTP\/2 test (for example curl -sI --http2 https:\/\/your.site<\/code>) shows HTTP\/1.1. Prevention<\/strong> [MAG212 analysis]<\/strong>: keep a list of every server that bundles a web server, including appliances, so the next httpd bug takes minutes to scope.<\/p>\n\n\n\n
    What else is in 2.4.71<\/h2>\n\n\n\n
    [Confirmed]<\/strong> The same release fixes two more flaws: CVE-2026-106023, rated Important, a NULL pointer dereference in mod_md that crashes a child process on 2.4.30 through 2.4.70; and CVE-2026-109163, rated Low, a one-byte stack overwrite in mod_vhost_alias that follows up an earlier fix. Sites that use mod_md for automatic Let\u2019s Encrypt certificates have a second reason to update.<\/p>\n\n\n\n
    [MAG212 analysis]<\/strong> Most organisations don\u2019t run upstream Apache directly; they run their Linux distribution\u2019s package, a control panel\u2019s build or an appliance\u2019s bundled copy. Distributions often backport fixes without changing the version number, so a server reporting 2.4.62 may already be fixed. Check your distribution\u2019s security tracker for CVE-2026-119618 rather than relying on the version string alone.<\/p>\n\n\n\n
    Why it matters<\/h2>\n\n\n\n
    Apache httpd runs on a huge share of the web, including school, small-business and hosting servers and many appliances that bundle it quietly. An unauthenticated remote code execution flaw in the HTTP\/2 path is the kind of bug exploit developers race to weaponise, and the two big voices disagree: Red Hat says a reliable exploit has been shown publicly, Wiz says none is available. That uncertainty is a reason to move, not to wait.<\/p>\n\n\n\n
    The bottom line<\/h2>\n\n\n\n
    Check whether each server is in the version range, loads mod_http2 and enables h2 or h2c. If all three are true, update to 2.4.71 or your distribution\u2019s fixed package; until you can, remove h2 and h2c from Protocols, and ask appliance vendors when their bundled httpd will be fixed.<\/p>\n\n\n\n
    How we label evidence: [Confirmed]<\/strong> comes from a primary source such as a vendor or CISA; [Reported]<\/strong> from a secondary outlet; [Claimed]<\/strong> from an attacker or an unverified party; [MAG212 analysis]<\/strong> is our judgement; [Unknown]<\/strong> means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.<\/em><\/p>\n\n\n\n
    \n\n\n\n
    This story is part of MAG212 CYBER Daily, 12 November 2026<\/a>, with the day\u2019s other verified stories, the Defender\u2019s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER<\/a>. By El Mostafa Ouchen.<\/p>\n\n","protected":false},"excerpt":{"rendered":"
    Apache rates CVE-2026-119618 in mod_http2 Critical: a synchronisation bug in assign_headers can corrupt the heap and allow remote code execution on httpd 2.4.55 to 2.4.70 with HTTP\/2 enabled. Red Hat and Wiz disagree on exploitability. How to tell if you\u2019re exposed and the stop-gap.<\/p>","protected":false},"author":1,"featured_media":4195,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,14],"tags":[332,333,107,287,334],"class_list":["post-4207","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","category-vulnerabilities","tag-apache-http-server","tag-http-2","tag-patch-management","tag-remote-code-execution","tag-web-security"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4207","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=4207"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4207\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/4195"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=4207"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=4207"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=4207"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}