Apache CVE-2026-119618: Critical HTTP/2 RCE (mod_http2) — Fixed in 2.4.71

What happened

Apache HTTP Server 2.4.71, released November 11, 2026, fixes CVE-2026-119618 — rated critical by the Apache Security Team: a concurrent execution using a shared resource with improper synchronization in mod_http2u2019s assign_headers() can lead to remote code execution. In practical terms: HTTP/2 streams processed in parallel can race on shared memory, and the resulting heap corruption is exploitable for code execution on the server.

The flaw was found by Anthropicu2019s OSS Scanner and independently by Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research (reported October 26 and November 3, 2026). No public exploit details are known at this time.

Who is affected

• Apache HTTP Server 2.4.55 through 2.4.70 with the HTTP/2 protocol (mod_http2) enabled.
• The standalone mod_h2 module from GitHub, versions 2.0.8 through 2.0.42.
• Servers with HTTP/2 disabled are not exposed through this path — but verify your configuration rather than assuming: HTTP/2 is enabled by default on modern stacks.

How to apply the fix

• cPanel & WHM (EasyApache 4): the fix arrives via an EasyApache release packaging httpd 2.4.71 — none has been announced yet; watch the cPanel changelog and update as soon as it ships.
• Self-managed Apache: upgrade to 2.4.71 from the official source or your package channel, then restart Apache.
• Distro packages (AlmaLinux, Ubuntu, …): fixed builds flow through vendor errata, which typically lag the upstream release by days — watch for the httpd security update.

The interim mitigation — disabling HTTP/2 — removes the vulnerable code path but sacrifices the protocol for every site on the server; treat it as a last resort only.

Fixed in the same 2.4.71 release

• CVE-2026-106023 (important): mod_md NULL pointer dereference, affects 2.4.30–2.4.70.
• CVE-2026-109163 (low): mod_vhost_alias 1-byte stack buffer overwrite, affects 2.4.69–2.4.70.

For SharedLicense customers

Your license is unaffected — this is Apache web-server software, not licensing. On cPanel, DirectAdmin and Plesk servers alike, the practical action is the same: get httpd 2.4.71 onto the box through your panelu2019s update channel as soon as it is offered, and restart the web server.