Apache HTTP Server 2.4.71 fixes CVE-2026-119618, a critical bug in mod_http2 that can let an unauthenticated remote attacker run code as the server process, The Hacker News and SecurityWeek report. Red Hat rates it 9.8.
- Affected: httpd 2.4.55 through 2.4.70, and standalone mod_h2 2.0.8 through 2.0.42. Only servers with HTTP/2 turned on (
h2orh2cinProtocols) are exposed. HTTP/1.1-only servers aren’t. - Who found it: Anthropic’s OSS Scanner reported it Oct. 26, and Google Cloud Vulnerability Research found it on its own Nov. 3. It’s a race condition that can corrupt server memory.
- Exploit status: Red Hat says public research shows a reliable exploit but doesn’t name it. Wiz says it hadn’t seen a working exploit or attacks in the wild. A public PoC crashes Apache but doesn’t show RCE.
- Distros: RHEL 9 and 10 have fixes (rated Important there because of a per-stream allocator). RHEL 8 and older don’t have the vulnerable code. Debian and Amazon Linux have tracker entries.
- 2.4.71 also fixes a mod_md crash and a small stack overwrite in mod_vhost_alias.
What to do
Update to 2.4.71 or your distro’s fixed package. If you can’t yet, Wiz suggests setting Protocols http/1.1 until you can. Defiant points out that no WordPress update fixes this, since it’s in the web server itself.
My take
Two AI-assisted teams finding the same race a week apart tells you where bug hunting is now. My own walkthrough for checking HTTP/2 on your servers is in this batch.
God Bless, and Happy hacking!
