TT-CSIRT – 463.12.11.26- Critical Remote Code Execution Vulnerability in Apache HTTP Server.
Please be advised that a critical vulnerability, designated as CVE-2026-119618, has been identified in the Apache HTTP Server HTTP/2 component (mod_http2). Exploitation may allow a threat actor to execute malicious code remotely with the privileges of the affected web-server process, potentially compromising hosted applications, sensitive information, and associated systems.
Please note:
The Apache Software Foundation released security update Apache HTTP Server 2.4.71 on 11 November 2026 to address this vulnerability. The vulnerability carries a vendor-assigned CVSS v3.1 score of 9.8 (Critical), as assessed by Red Hat.
CVE-2026-119618 involves a race condition within the assign_headers() function of the Apache HTTP/2 module (mod_http2). Improper synchronization may lead to heap memory corruption, potentially allowing remote code execution. The vulnerability affects Apache HTTP Server versions 2.4.55 through 2.4.70 where HTTP/2 functionality is enabled.
Affected Systems and Remediation:
| Component | Affected Range |
| Apache HTTP Server | Versions 2.4.55 through 2.4.70 inclusive; fixed in 2.4.71. |
| Standalone mod_h2 (GitHub) | Versions 2.0.8 through 2.0.42. Consult the project or distribution for fixed packaging. |
| Configuration Prerequisite | mod_http2 loaded and HTTP/2 (h2 or h2c) enabled. HTTP/1.1-only servers are not vulnerable to this issue. |
| Linux distribution packages | Vendor-maintained backports may fix older displayed versions. Confirm against distribution security advisories. |
Potential Impact
- Remote execution of attacker-controlled code with the privileges of the Apache worker process.
- Unauthorized access to or modification of application data and sensitive information accessible to that process.
- Web-service crashes, disruption, or broader compromise following successful exploitation.
Recommended Actions
- Patch promptly. Upgrade upstream Apache HTTP Server to version 2.4.71 or install the Linux vendor’s patched httpd/mod_http2 package. Prioritize internet-facing systems and confirm the package advisory rather than relying solely on an Apache version banner.
- Reduce exposure if patching is delayed. Where operationally acceptable, disable HTTP/2 (both h2 and h2c) in Apache’s Protocols configuration, validate configuration, and reload or restart the service. Retain HTTP/1.1 while the system awaits a fix.
Quick Administrator Checks (Linux)
apache2ctl -v # Debian/Ubuntu (or httpd -v on RHEL)
apache2ctl -M | grep http2 # Check whether the HTTP/2 module is loaded
grep -Rin ‘Protocols’ /etc/apache2 /etc/httpd 2>/dev/null # Review configured protocols
Note: A loaded module alone does not prove exploitability. Check effective per-virtual-host HTTP/2 configuration and vendor patch status.
References:
