Back to Security Advisories

Apache CVE-2026-119618: Critical HTTP/2 RCE (mod_http2) — Fixed in 2.4.71

Apache HTTP Server 2.4.71, released November 11, 2026, fixes CVE-2026-119618: a critical flaw in the HTTP/2 module (mod_http2) where concurrent execution using a shared resource with improper synchronization in assign_headers() can lead to remote code execution. Every server running Apache 2.4.55 through 2.4.70 with HTTP/2 enabled is exposed to an unauthenticated attacker — update to 2.4.71 as a priority.

Critical
Apache

Affected Versions

2.4.71

Default Update CMD

apachectl -v   # verify the running version - must report 2.4.71 or later after the upgrade; distro servers: sudo dnf update httpd && sudo systemctl restart httpd

What this means under a SharedLicense license

An unauthenticated remote attacker who reaches an affected HTTP/2 endpoint can corrupt heap memory and potentially execute code on the web server itself — the highest-value target on any hosting stack. No exploit details are public yet (per SANS ISC), which is the window to patch within.

What happened

Apache HTTP Server 2.4.71, released November 11, 2026, fixes CVE-2026-119618 — rated critical by the Apache Security Team: a concurrent execution using a shared resource with improper synchronization in mod_http2u2019s assign_headers() can lead to remote code execution. In practical terms: HTTP/2 streams processed in parallel can race on shared memory, and the resulting heap corruption is exploitable for code execution on the server.

The flaw was found by Anthropicu2019s OSS Scanner and independently by Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research (reported October 26 and November 3, 2026). No public exploit details are known at this time.

Who is affected

  • Apache HTTP Server 2.4.55 through 2.4.70 with the HTTP/2 protocol (mod_http2) enabled.
  • The standalone mod_h2 module from GitHub, versions 2.0.8 through 2.0.42.
  • Servers with HTTP/2 disabled are not exposed through this path — but verify your configuration rather than assuming: HTTP/2 is enabled by default on modern stacks.

How to apply the fix

  • cPanel & WHM (EasyApache 4): the fix arrives via an EasyApache release packaging httpd 2.4.71 — none has been announced yet; watch the cPanel changelog and update as soon as it ships.
  • Self-managed Apache: upgrade to 2.4.71 from the official source or your package channel, then restart Apache.
  • Distro packages (AlmaLinux, Ubuntu, …): fixed builds flow through vendor errata, which typically lag the upstream release by days — watch for the httpd security update.

The interim mitigation — disabling HTTP/2 — removes the vulnerable code path but sacrifices the protocol for every site on the server; treat it as a last resort only.

Fixed in the same 2.4.71 release

  • CVE-2026-106023 (important): mod_md NULL pointer dereference, affects 2.4.30–2.4.70.
  • CVE-2026-109163 (low): mod_vhost_alias 1-byte stack buffer overwrite, affects 2.4.69–2.4.70.

For SharedLicense customers

Your license is unaffected — this is Apache web-server software, not licensing. On cPanel, DirectAdmin and Plesk servers alike, the practical action is the same: get httpd 2.4.71 onto the box through your panelu2019s update channel as soon as it is offered, and restart the web server.

Frequently Asked Questions

Am I affected if I do not use HTTP/2?
The flaw lives in mod_http2, so servers without the HTTP/2 module enabled are not exposed through this path — but most modern hosting stacks run HTTP/2 by default, so verify rather than assume.
Is there a workaround short of upgrading?
Disabling HTTP/2 (mod_http2) removes the vulnerable code path, but that sacrifices the protocol benefits for every site on the server. Upgrading to Apache 2.4.71 is the real fix.
How do cPanel & WHM / EasyApache servers get the fix?
Through an EasyApache 4 release that packages httpd 2.4.71 — no such release has been announced yet, so watch the cPanel changelog; distro packages (AlmaLinux et al.) may also lag the upstream release.
Is a CVSS score published?
NVD has assigned CWE-362 (race condition: concurrent execution using a shared resource with improper synchronization); the CVSS base score is still pending as of November 12, 2026 — Apache itself rates the flaw critical. This pageu2019s daily enrichment picks up the score when NVD publishes it.

References

Security Advisories

Related Advisories

Linux Kernel (HWE) Vulnerabilities — Ubuntu Security Update (USN-9018-2)

2026-11-12

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System