Apache HTTP Server: Critical RCE Vulnerability (CVE-2026-119618)

Apache HTTP Server 2.4.71, released on November 11, 2026, fixes CVE-2026-119618 — a heap corruption flaw in the HTTP/2 module, mod_http2, that Apache’s advisory says can lead to remote code execution.

The flaw affects Apache HTTP Server 2.4.55 through 2.4.70, and standalone mod_h2 2.0.8 through 2.0.42, when HTTP/2 (h2 or h2c) is enabled. Servers that only speak HTTP/1.1 are not affected. Red Hat and Amazon rate the issue as critical (CVSS 9.8); CISA rates it as high severity (CVSS 8.1). As of November 13, 2026, no public proof of concept has been confirmed and there is no report of in-the-wild exploitation.

Upgrade paths depend on your distribution and its backport policy. A version string alone does not confirm patch status — check the vendor advisory. Debian 12 and 13 already carry the fix (2.4.71-1deb12u1, 2.4.71-1deb13u1), and Alpine, Fedora, Amazon Linux 2 and 2023, Wolfi and Chainguard have updates ready.

HTTP/2 is not enabled by default. The flaw is reachable only when the Protocols directive selects h2 or h2c, so first confirm whether your instances enable HTTP/2 at all, then patch those. Internet-facing instances, particularly reverse proxies, go first.

The same release also addresses CVE-2026-106023 in mod_md and CVE-2026-109163 in mod_vhost_alias, both lower severity. Operators who recently moved to 2.4.67 to address the May HTTP/2 flaw (CVE-2026-23918) are still inside the affected range.

Apache has been explicit about what triggers the flaw: an unauthenticated attacker does it by sending specially crafted HTTP/2 frames. That places every HTTP/2-enabled httpd in the first patch tier.

There is no public exploit and no confirmed compromise. That is the wrong time to wait for one.