Skip to content
securitytabs

LiveUpdated

Apache fixes critical remote code execution flaw in HTTP/2 module

A serious flaw in the widely used Apache web server could let an outsider run code on servers that have the HTTP/2 feature switched on. A fixed version is out, and organizations running affected versions should plan to update.

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

The Apache HTTP Server project disclosed CVE-2026-119618, described as heap corruption and remote code execution in the mod_http2 module. The project released HTTP Server 2.4.71 to fix it. [1][2]

The Hacker News reports the flaw affects versions 2.4.55 through 2.4.70 and can let an unauthenticated remote attacker run code on the server. Red Hat, which ships the server in Red Hat Enterprise Linux, says only servers with HTTP/2 enabled are affected. [2]

Exposure and exploitation

Wiz says 64% of the cloud environments it observes have resources vulnerable to the flaw, and advises immediate patching. The cited sources do not report exploitation in the wild, and CISA's Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, does not list the CVE. No CVSS score has been published yet. [3][2]

What to do

Apache's fix is version 2.4.71. Operators who cannot update at once can check whether HTTP/2 is enabled, since only such servers are affected according to Red Hat. [1][2]

Timeline

  1. Apache's fixed release 2.4.71 for the critical mod_http2 flaw was covered in the SANS daily briefing. [1]

  2. Apache's release of HTTP Server 2.4.71, which fixes the mod_http2 flaw, was reported as released the previous day. [2]

  3. Wiz published guidance saying 64% of cloud environments have vulnerable resources. [3]

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Websites on hosting plans may run Apache; a fixed version, 2.4.71, has been released. [1]

What to do

  1. Ask your hosting provider whether its Apache servers have been updated to 2.4.71. [1]
  2. If you manage your own server, update Apache to 2.4.71. [2]

Mid-size company

A small IT or security team

What to know

Versions 2.4.55 through 2.4.70 are affected when HTTP/2 is enabled, and no exploitation has been reported in the cited sources. [2]

What to do

  1. Inventory Apache servers and identify those running versions 2.4.55 through 2.4.70. [2]
  2. Update affected servers to 2.4.71 in your next patch window, starting with internet-facing hosts. [1][3]

Large enterprise

A security operations team

What to know

Wiz reports 64% of cloud environments it sees have vulnerable resources, so exposure may be broad, including in vendor-shipped packages such as Red Hat's. [3][2]

What to do

  1. Scan cloud and on-premises estates for Apache 2.4.55 through 2.4.70 with HTTP/2 enabled. [2][3]
  2. Patch to 2.4.71 or the vendor's equivalent build, and watch Apache's advisory for exploitation updates. [1]

Sources

  1. [1]SANS Internet Storm Center StormCast · Nov 12, 02:00 UTC
    SANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119618); Fortinet FortiMail Criticals; Ivanti EPM SQLi (CVE-2026-121653); Windows SignDrop CLFS; N-able N-central HF2context
  2. [2]The Hacker News · Nov 12, 05:12 UTC
    Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotelycontext
  3. [3]Wiz Blog · Nov 11, 19:49 UTC
    Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Knowcontext