A critical remote code execution vulnerability in Apache HTTP Server lets unauthenticated attackers take full control of vulnerable systems.
Tracked as CVE-2026-119618, the flaw resides in the HTTP/2 module, specifically within the assign_headers() function of mod_http2, according to security firm Wiz. The vulnerability stems from a concurrent execution race condition when handling shared resources. It affects server versions 2.4.55 through 2.4.70. The Apache HTTP Server project fixed the issue in version 2.4.71, released yesterday.
Only servers running with HTTP/2 enabled are vulnerable. An attacker reaching the server can corrupt heap memory to achieve arbitrary code execution with the privileges of the web server process, Wiz reported. The vulnerability carries a 9.8 out of 10 score on the CVSS scale.
Researchers and vendors assess the severity and exploitability of the flaw
Public research has demonstrated a reliable exploit against a server running in its default configuration with mod_http2 enabled, according to Red Hat. Security company Wiz said that no exploit was available and that no exploitation in the wild had been reported.
Red Hat shipped fixes for Red Hat Enterprise Linux 9 and 10 yesterday. Because its mod_http2 packages assign a dedicated memory allocator to every HTTP/2 stream—greatly increasing the difficulty of an attack—the vendor classifies this issue as Important instead of Critical on those platforms. Red Hat Enterprise Linux 8 and earlier do not contain the vulnerable code.
Data from Wiz indicates that 64% of cloud environments have resources vulnerable to CVE-2026-119618. 51% of cloud environments feature publicly exposed instances before taking configuration into account.
How administrators can disable HTTP/2 to mitigate the risk
HTTP/2 runs only where the Protocols directive turns it on. Administrators can set the directive using h2 for HTTP/2 over TLS and h2c for HTTP/2 over plain TCP across the whole server or for a single virtual host.
Wiz advises administrators who cannot update immediately to remove h2 and h2c from the Protocols directive, leaving only Protocols http/1.1.
Versions 2.0.8 through 2.0.42 of the mod_h2 module, distributed independently on GitHub, are impacted by this issue. The standalone project has published no fixed release, and its repository has been read-only since it was archived on June 9.
Timeline of Discoveries and Previous Patches
Anthropic’s OSS Scanner reported the flaw on October 26. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported the issue last week.
An earlier HTTP/2 vulnerability, CVE-2026-23918, was patched in version 2.4.67, which was released on May 4. Servers updated to that release or any subsequent version up to 2.4.70 still run code affected by the new vulnerability.
Which Apache HTTP Server versions are affected and how to mitigate them?
Which Apache HTTP Server versions are affected by CVE-2026-119618?
The vulnerability affects Apache HTTP Server versions 2.4.55 through 2.4.70, along with standalone mod_h2 builds from version 2.0.8 through 2.0.42.
How can administrators mitigate the risk without patching immediately?
Administrators can remove h2 and h2c from the Protocols directive in the server configuration, leaving only Protocols http/1.1 active.
What is the status of Ubuntu regarding this vulnerability?
Ubuntu’s CVE tracker had no page for the flaw when checked by The Hacker News.