The Apache Software Foundation has patched a critical flaw in the open-source Apache HTTP Server that could let an attacker take over a vulnerable server without logging in. Apache's security advisory rates the bug, CVE-2026-119618, critical, and the fix shipped in version 2.4.71 on Wednesday, Nov. 11.
The flaw sits in mod_http2, the module that lets Apache talk to browsers over HTTP/2. It affects Apache 2.4.55 through 2.4.70 and standalone mod_h2 releases 2.0.8 through 2.0.42. Only servers with HTTP/2 turned on are exposed, so a server that speaks only the older HTTP/1.1 protocol is safe from this bug.
Two teams found it. Apache credits Anthropic's OSS Scanner, which reported it on Oct. 26, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research, who reported it on Nov. 3. Anthropic's report came first.
What the flaw does
HTTP/2 lets a browser send many requests at once over a single connection, and Apache splits that work across several threads that share some of the same memory. According to Red Hat's assessment, a thread-safety mistake lets one thread write into memory that belongs to another, corrupting the server's memory. An attacker who can reach the server could use that to run commands on it, take control of the server process and read or change data.
Red Hat scores the bug 9.8 out of 10. It says public research has shown a reliable exploit against a server running a default setup with mod_http2 enabled. Cloud security firm Wiz wrote on Nov. 11 that no exploit was public and no attacks had been reported at that point. The federal Cybersecurity and Infrastructure Security Agency had not added the flaw to its catalog of vulnerabilities known to be exploited as of Thursday.
Who is affected
Wiz said 64% of the cloud environments it monitors have resources running a vulnerable version, and 51% have such a server open to the internet. Wiz noted that those figures ignore server configuration. Some of those servers may not have HTTP/2 on.
Exposure also depends on where Apache came from. Red Hat says Red Hat Enterprise Linux 8 and older are not affected because their mod_http2 predates the faulty code. RHEL 9 and RHEL 10 get an "Important" rating instead of critical. Their builds give each HTTP/2 stream its own memory pool, which makes an attack much harder. Red Hat released fixes for both on Nov. 11. Debian has shipped a fixed package for Debian 13 in security advisory DSA-6620-1, and SUSE lists its supported enterprise and openSUSE releases as affected.
How to fix it
Server administrators should move to Apache 2.4.71 or to their Linux distribution's patched package and restart the web server, and anyone who builds mod_h2 from its GitHub source should update past release 2.0.42.
Apache's advisory lists no workaround. For servers that cannot be updated right away, Wiz recommends turning HTTP/2 off by removing h2 and h2c from the Protocols line in the Apache configuration, leaving Protocols http/1.1. Sites keep loading over HTTP/1.1 in the meantime.
Small businesses and bloggers on shared hosting usually do not manage Apache themselves. Their hosting company runs the server, so the practical step is to check the host's status page or ask support whether the 2.4.71 fix is in place. People who only browse websites do not need to do anything.
Two smaller fixes in the same release
Version 2.4.71 also closes two lesser bugs. CVE-2026-106023, rated important, is a crash in mod_md, the module that manages TLS certificates, and affects Apache 2.4.30 through 2.4.70. CVE-2026-109163, rated low, is a one-byte memory overwrite in mod_vhost_alias that affects only 2.4.69 and 2.4.70. Apache does not describe either one as allowing a takeover.
