Apache HTTP Server HTTP Server patches critical HTTP/2 remote code execution flaw

Apache Software Foundation has patched a critical vulnerability in its HTTP/2 module, mod_http2, which could allow unauthenticated attackers to execute code remotely. The flaw, tracked as CVE-2026-119618, affects versions 2.4.55 through 2.4.70 and is addressed in the newly released version 2.4.71. This vulnerability is significant as Apache HTTP Server is a widely used web server software, and the flaw could potentially allow attackers to take full control of affected servers.

The vulnerability, discovered by Anthropic's OSS Scanner and Google Cloud's Vulnerability Research teams, is a race condition in the mod_http2 module, which can lead to heap memory corruption. This type of flaw occurs when multiple processes access shared resources without proper synchronization, potentially allowing an attacker to execute arbitrary commands with the privileges of the web server process. Apache describes the issue as a "Concurrent Execution using Shared Resource with Improper Synchronization vulnerability."

Red Hat, which includes Apache HTTP Server in its Enterprise Linux distribution, has noted that only servers with HTTP/2 enabled are affected. The company rates the flaw at 9.8 out of 10 on the CVSS scale, indicating its critical nature. However, Red Hat's specific builds for Enterprise Linux 9 and 10 mitigate some risk by giving each HTTP/2 stream its own memory allocator, which complicates exploitation attempts. Red Hat has already released updates for these versions.

Security company Wiz reported that although a reliable exploit has been demonstrated in research, no public exploits or in-the-wild attacks have been reported. Wiz also highlights that a significant percentage of cloud environments have vulnerable resources, many of which are publicly exposed. The company advises administrators to either update to the latest Apache HTTP Server version or disable HTTP/2 by removing 'h2' and 'h2c' from the Protocols directive until an update can be applied.

The Apache HTTP Server advisory does not provide a workaround, but the urgency of updating is underscored by the potential impact of the vulnerability. The standalone mod_h2 project, affected from version 2.0.8 through 2.0.42, has not yet released a fixed version, and its repository has been archived, leaving users to rely on the Protocols directive change as a temporary measure.