There is a CVSS 9.8 pre-authentication remote code execution vulnerability in Apache HTTP Server’s mod_http2 module. It was fixed on 11 November 2026 in version 2.4.71. If you run Apache with HTTP/2 enabled and you have not patched, this post is for you.
What happens
mod_http2 is designed so that worker threads never touch the connection’s shared allocator — each worker gets a private one. assign_headers() breaks that rule for a specific request shape: body-less, with Content-Type and no Content-Length, when the request header table is full. The worker writes a synthesised Content-Length: 0 into the shared stream table. That write races with the connection thread on a lock-free free list. Two threads pop the same node. Heap corrupts. The process ends up with double-owned memory, and that’s the primitive the exploit turns into code execution.
No credentials. No user interaction. The attacker sends an HTTP/2 request.
Who’s affected
Apache HTTP Server 2.4.55 through 2.4.70, and standalone mod_h2 2.0.8 through 2.0.42 — but only if HTTP/2 is enabled. That’s the h2 or h2c token in the Protocols directive. The directive can be set server-wide or per virtual host, so check both.
Scale
Wiz reports 64% of cloud environments have resources on a vulnerable version, and 51% have publicly exposed instances. A containerised differential lab, ThreadSanitizer evidence, and a stdlib HTTP/2 PoC are already on GitHub under the CVE identifier.
Fix
Upgrade to Apache HTTP Server 2.4.71 or mod_h2 2.0.43. RHEL 9: mod_http2-2.0.26-7.el9_9.1. RHEL 10: mod_http2-2.0.29-5.el10_3.1. Container images built before 11 November need a rebuild.
If you can’t patch today: Protocols http/1.1 in every config file and every virtual host block.
Full write-up with hunt guidance and Red Hat vs upstream rating breakdown: https://threataft.com/articles/cve-2026-119618-apache-mod-http2-race-condition-rce
Top comments (0)