DEV Community

Cover image for Apache HTTP Server HTTP/2 RCE (CVE-2026-119618): Check and Patch
epifive
epifive

Posted on Originally published at epifive.com

Apache HTTP Server HTTP/2 RCE (CVE-2026-119618): Check and Patch

#tutorial

Apache HTTP Server 2.4.71, released on 2026-11-11, fixes CVE-2026-119618, a critical flaw in the HTTP/2 module (mod_http2) that the Apache project says "can lead to RCE" (remote code execution). Releases 2.4.55 through 2.4.70 are affected. The most important action is to upgrade to 2.4.71; if you cannot do that today, make sure HTTP/2 is turned off by serving only Protocols http/1.1.

What happened

Dates below come from the Apache HTTP Server project's own security page for the 2.4 series, which we treat as the primary source.

Date What the primary source says
2026-10-26 The issue was reported to the project by Anthropic's OSS Scanner (tracked by the reporter as ANT-2026-MAPKT6MZ).
2026-11-03 Google Cloud Vulnerability Research reported the issue independently.
2026-11-11 The fix was committed (commit 824beab) and Apache HTTP Server 2.4.71 was released. The release lists 3 CVEs: 1 critical, 1 important, 1 low.
2026-11-11 Wiz published an analysis rating the issue critical.
2026-11-12 BleepingComputer reported on the fix and cited the Apache advisory and the Wiz analysis.

The Apache description reads: "Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE." In plain words, it is a race condition. Per Wiz, a remote, unauthenticated attacker could corrupt heap memory and potentially achieve code execution with the web server process's privileges.

What the sources say, and what they do not

Statement Who made it Status
Versions 2.4.55 through 2.4.70 are affected; 2.4.71 fixes it Apache HTTP Server project Primary source; matches Wiz
Standalone mod_h2 2.0.8 through 2.0.42 is affected Apache HTTP Server project Primary source; matches Wiz
No exploit is available and no in-the-wild exploitation is reported Wiz, as of 2026-11-11 A vendor statement about its own knowledge at publication; not confirmed by Apache
64% of cloud environments have vulnerable resources, 51% have publicly exposed instances Wiz telemetry A claim from one vendor's data; Wiz says the figures do not account for configuration
The condition is real and patching or disabling HTTP/2 is advised watchTowr, as reported by BleepingComputer Reported by a news outlet; we did not open watchTowr's own page
Exact exploitation details, number of affected servers worldwide Nobody Unknown; the Apache page contains no proof of concept

The same release also fixes two other issues: CVE-2026-106023 (important, a NULL pointer dereference in mod_md that can crash a child process, affecting 2.4.30 through 2.4.70) and CVE-2026-109163 (low, a 1-byte stack buffer overwrite in mod_vhost_alias, affecting 2.4.69 and 2.4.70). Upgrading to 2.4.71 covers all three.

Am I affected?

You are potentially affected if all of the following are true:

  1. You run Apache HTTP Server (httpd) at a version from 2.4.55 through 2.4.70, or the standalone mod_h2 from GitHub at 2.0.8 through 2.0.42.
  2. mod_http2 is loaded.
  3. HTTP/2 is actually enabled through the Protocols directive.

On point 3, the Apache documentation gives the default as Protocols http/1.1 and says "By default, only the http/1.1 protocol ... is allowed." The mod_http2 page adds: "You must enable HTTP/2 via Protocols in order to use the functionality." Wiz also states the issue applies only where HTTP/2 is used. So a server that has never had h2 or h2c added to Protocols should not be using HTTP/2. Do not rely on that alone: many hosting panels, container images and tutorials add Protocols h2 http/1.1 automatically, and a virtual host can set its own value.

Indicators of compromise

None. Neither the Apache advisory nor the Wiz analysis publishes indicators of compromise, and we are not adding any. At the time of writing there is no published way to confirm from logs that this specific flaw was used.

What to do now

  1. Find every Apache HTTP Server you run (web servers, reverse proxies, container images, appliances that embed httpd).
  2. Check the version on each (Step 1 below).
  3. Check whether HTTP/2 is enabled (Step 2).
  4. Upgrade to 2.4.71 or later using your normal build or package process (Step 3).
  5. If you cannot upgrade today, disable HTTP/2 (Step 4) and schedule the upgrade.
  6. Verify and restart (Step 5).

Step 1: Check the version

The httpd manual documents -v ("Print the version of httpd, and then exit.") and -V ("Print the version and build parameters of httpd, and then exit."):

httpd -v
Enter fullscreen mode Exit fullscreen mode

On some distributions the binary is named differently; use whatever your installation calls it. If the version is 2.4.55 through 2.4.70, you are in the affected range. If you installed through a distribution or vendor package, also read that vendor's own security notice, because the package's version label may not follow the upstream number. We did not verify any distribution's handling of this fix.

Step 2: Check whether mod_http2 is loaded and HTTP/2 is on

List loaded modules. The manual describes -M as "Dump a list of loaded Static and Shared Modules", and -t with -D DUMP_MODULES prints all loaded modules after the syntax test:

httpd -M
httpd -t -D DUMP_MODULES
Enter fullscreen mode Exit fullscreen mode

Look for http2_module in the output. Then search your configuration for the Protocols directive. Replace the path with your configuration directory:

grep -rn "Protocols" /path/to/your/httpd/conf
Enter fullscreen mode Exit fullscreen mode

Interpret the results with the documented rules:

  • Protocols h2 http/1.1 means HTTP/2 over TLS is enabled for that scope.
  • Protocols h2 h2c http/1.1 means HTTP/2 over TLS and over cleartext is enabled.
  • A Protocols line inside a <VirtualHost> replaces any Protocols line in the base server for that host. The Apache docs say base-server protocols are inherited "only if the virtual host has no own Protocols directive." Check every virtual host.
  • No Protocols line at all means the default, http/1.1.

Step 3: Upgrade to Apache HTTP Server 2.4.71

Upgrade through whatever method you used to install: your package manager, your container base image, or a source build. The Apache security page lists 2.4.71 as the fixed release for Apache HTTP Server. The page does not list a fixed version for the standalone mod_h2 from GitHub, and Wiz's table is internally inconsistent about it (it lists "2.0.42 and newer" as patched while the affected range ends at 2.0.42). If you use the standalone mod_h2, check that project's own release notes before relying on a specific version number. We did not open them.

After upgrading, run httpd -v again to confirm the version.

Step 4: If you cannot upgrade today, disable HTTP/2

The Apache HTTP/2 guide says, under "Disabling HTTP/2": to serve only HTTP/1, set

Protocols http/1.1
Enter fullscreen mode Exit fullscreen mode

It also says you can remove the Protocols h2 ... line from the relevant scope, or omit LoadModule http2_module if you do not need the module at all. Wiz's mitigation matches: restrict protocols to HTTP/1.1 and remove h2 and h2c references. Be thorough, because a single virtual host with its own Protocols h2 http/1.1 line stays exposed even if the base server is fixed.

Two documented side effects to know about: http/1.1 is "always available and cannot be excluded," so clients will keep working, and browsers that used HTTP/2 simply fall back to HTTP/1.1. Pages may load somewhat differently, but the Apache documentation does not describe any loss of functionality.

Step 5: Validate the configuration and restart

Run the syntax test, which the manual says exits with a return code of 0 for "Syntax OK":

httpd -t
Enter fullscreen mode Exit fullscreen mode

Then restart or reload the server using your platform's service manager so the change takes effect, and repeat Step 2 to confirm no scope still enables h2 or h2c if you chose to disable it.

How to prevent it

  • Keep a version inventory. The affected window (2.4.55 through 2.4.70) is wide. Knowing which hosts run which release is the fastest way to answer the next advisory.
  • Enable only what you use. The Apache documentation notes that Protocols defaults to http/1.1, that unavailable protocols are ignored, and that LoadModule http2_module can be omitted. If a server does not need HTTP/2, leaving the module out reduces exposure to HTTP/2 flaws.
  • Do not leave HTTP/2 on in forgotten virtual hosts. Search all included configuration files, not only the main one.
  • Watch the official advisory page. The Apache HTTP Server 2.4 security page at httpd.apache.org lists each CVE with affected and fixed versions and dates.
  • Plan for the web server process's privileges. The risk described by Wiz is code execution with the privileges of the web server process. Running httpd as an unprivileged account and limiting what that account can reach is general hardening; we did not verify specific settings for this article, so follow your platform's documentation.

Checklist

  • [ ] Every Apache HTTP Server host is listed with its version.
  • [ ] Hosts on 2.4.55 through 2.4.70 are upgraded to 2.4.71 or later.
  • [ ] Standalone mod_h2 users have checked that project's release notes.
  • [ ] Where upgrading must wait, Protocols http/1.1 is set in every scope, or mod_http2 is not loaded.
  • [ ] httpd -t returns Syntax OK and the service has been restarted.
  • [ ] Your team knows that no public exploit was reported as of 2026-11-11 and will re-check the advisory.

What we checked

  • Opened the Apache HTTP Server 2.4 security page on 2026-11-13. It lists CVE-2026-119618 as critical, affecting 2.4.55 through 2.4.70, fixed by commit 824beab on 2026-11-11, with 2.4.71 released 2026-11-11. It also lists the two other CVEs fixed in the same release. We read the first 100,000 characters of that long page; the rest was not read.
  • Opened the Wiz analysis on 2026-11-13. The affected versions and the 2.4.71 fix match the Apache page. Wiz's statement of no known exploitation is its own and is dated to its publication. Its mod_h2 fixed-version wording conflicts with the affected range, so we left a fixed mod_h2 version out.
  • Opened the BleepingComputer report on 2026-11-13. It matches the Apache and Wiz facts; the watchTowr statement comes only from that report.
  • Cross-checked HTTP/2 being off by default between the Apache core documentation (Protocols default http/1.1) and Wiz's note that HTTP/2 must be in use.
  • Opened the Apache HTTP/2 guide, the mod_http2 page, the core Protocols directive entry and the httpd program page, and used only the directives and options quoted above.
  • The commands in this guide are not run output: we did not run them. They follow the Apache manual, and we show no output for them.
  • Not tested on a live server; we did not try to exploit or reproduce the flaw, and we did not open watchTowr's or the mod_h2 project's own pages.

Last tested: 2026-11-13

Sources

This guide was researched and drafted with AI assistance and checked against the vendor documentation listed in its References. Read the maintained version and related guides on EpiFive.

Top comments (0)