Apache HTTP Server Vulnerability CVE-2026-119618: Critical mod_http2 Flaw Can Lead to Remote Code Execution, Fixed in 2.4.71

Apache has released Apache HTTP Server 2.4.71 to fix CVE-2026-119618. If your website, web app or API runs on Apache, schedule this update for this week, because your web server is the part of your business that the whole internet can reach. The flaw is in the mod_http2 module, the Apache project rates it critical, and Apache says it can lead to remote code execution.

The fix came out on 2026-11-11. Below is what is confirmed, what is still not known, and how to check your own servers.

What is CVE-2026-119618?

Apache's security page lists CVE-2026-119618 under the title "mod_http2: heap corruption and RCE in assign_headers". Apache describes it this way:

"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE."

In plain English: two parts of the server can work on the same piece of memory at the same time without coordinating properly. Security people call that a race condition. Here it can corrupt memory on the heap, and Apache says that can lead to remote code execution (RCE). RCE means someone outside your network could run their own code on your server.

Apache rates the flaw critical.

Which Apache versions are affected?

Here is what the sources confirm and what they leave out.

Confirmed:

• The flaw is in Apache HTTP Server's mod_http2 module, in the assign_headers() function.
• It also affects the standalone mod_h2 module distributed on GitHub. Apache lists the affected mod_h2 releases as 2.0.8 through 2.0.42.
• The fix is Apache HTTP Server 2.4.71, released 2026-11-11.

Not confirmed in the sources for this post:

• The exact range of Apache HTTP Server releases affected. Some reports give a specific version range and a numeric severity score. We could not confirm either in the primary sources, so we are not repeating them. If your server runs a version older than 2.4.71 and loads mod_http2, assume you need the update.
• Whether an attacker needs to log in first, or what conditions they need.
• Whether there is an official workaround. The sources we confirmed do not list one. The update is the fix.

Is CVE-2026-119618 being exploited?

Not as far as anyone has reported. Aikido, a security company, wrote in its write-up of the flaw: "As of publication, there are no reports of exploitation in the wild."

That was true when Aikido published, and it is no promise for next week. Once a critical web server fix is public, attackers can compare the old and new code to work out what changed. That makes the next few days the best time to patch.

Who found the Apache mod_http2 flaw?

Apache credits two finders, who reported it on different dates:

• Anthropic's OSS Scanner, as vulnerability ANT-2026-MAPKT6MZ, reported 2026-10-26.
• Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research, reported 2026-11-03.

Apache released 2.4.71 on 2026-11-11, a little over two weeks after the first report.

How to fix the Apache mod_http2 vulnerability this week

One caution about step 4. If Apache came from your Linux distribution or your hosting company, the version number on your server may not match Apache's own numbering. What counts is whether your supplier's package includes the fix for CVE-2026-119618, so ask them by CVE number.

Why the Apache vulnerability matters for a business website

Apache runs websites, online stores, booking systems and APIs, all of them open to anyone on the internet by design. A flaw that can lead to remote code execution on that server puts at risk whatever the server can reach:

• Customer data stored by the website or passed through it, such as forms, accounts and orders.
• Credentials in configuration files, such as database passwords and API keys for payment or email services.
• Your reputation, if the site starts serving something you did not put there.
• The rest of your network, if the web server connects to internal systems.

The harder problem is often knowing who is responsible. A site built years ago may sit on a server nobody has logged into since launch. A developer may have moved on, or a hosting plan may cover the hardware but not the software. If you cannot say today who will install Apache 2.4.71 on your servers, that gap matters more than this one CVE.

If you run your own servers, our self-hosting and infrastructure page explains how we set them up so updates like this are routine.

Apache CVE-2026-119618 questions people are asking

What is CVE-2026-119618?

It is a critical flaw in Apache HTTP Server's mod_http2 module, in the assign_headers() function. Apache says it can lead to remote code execution.

What version fixes the Apache mod_http2 vulnerability?

Apache HTTP Server 2.4.71, released 2026-11-11.

Is standalone mod_h2 affected?

Yes. Apache lists mod_h2 from GitHub, versions 2.0.8 through 2.0.42, as affected.

Is the Apache HTTP2 RCE being exploited?

Aikido reported no exploitation in the wild as of its publication. That can change, so patch now rather than waiting.

Which Apache HTTP Server versions are vulnerable?

The primary sources we confirmed do not give the exact range of affected Apache HTTP Server releases. If you run anything older than 2.4.71 with mod_http2 enabled, treat it as needing the update.

Is there a workaround if I cannot update right away?

The sources we confirmed do not list an official workaround. Ask your hosting provider or vendor what they recommend, and plan the update as soon as you can.

Does this affect my website if I use a hosting company?

It may, if your host runs Apache with mod_http2. Ask them to confirm in writing that CVE-2026-119618 is fixed on your server.

The bigger lesson

Critical web server flaws will keep turning up. This one was reported to Apache by two separate teams in about a week. What decides the outcome for a business is whether someone knows which servers it runs, checks them when a fix ships, and confirms the fix by CVE number. That should be a routine job with a named owner, not a scramble after a headline.

See how we harden and maintain servers at /tech/security-hardening, or get a quote to have yours checked.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: Apache HTTP Server vulnerabilities list; Aikido: CVE-2026-119618 Apache HTTP Server RCE.