Apache has fixed a critical HTTP server vulnerability that could allow unauthenticated remote code execution (RCE), following independent findings from Anthropic and Google researchers.
Tracked as CVE-2026-119618The flaw affects versions 2.4.55 to 2.4.70 of the Apache HTTP server. The issue was resolved on November 11 with the release of version 2.4.71. It resides in mod_http2, the module responsible for handling HTTP/2 traffic.
The vulnerability involves a race condition in which multiple threads inappropriately access shared resources, potentially corrupting server memory.
According to Red hatan attacker could exploit the issue remotely without authentication to execute arbitrary commands and take control of the server process. Red Hat gave the vulnerability a CVSS score of 9.8 and explained that “only servers with HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable.”
Apache credited Anthropic’s OSS Scanner reported the flaw on October 26. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research independently reported the same vulnerability on November 3.
Cloud Security Company Wiz reported that 64% of cloud environments in its data contained resources running affected Apache versions, while 51% had publicly exposed instances. The company cautioned that these numbers do not take into account server configuration and therefore do not necessarily represent usable installations.
Red Hat says public research has demonstrated a reliable exploit against a server with mod_http2 enabled, but its advisory does not identify the research.
Wiz noted that when his blog was published on November 11, no exploits were available and there were no reports of exploitation in the wild.
A proof of concept accessible to the public (PoC) on GitHub reports memory corruption and Apache process crashes, but does not demonstrate remote code execution.
Organizations are advised to install Apache HTTP Server 2.4.71 or vendor-provided packages. Disabling HTTP/2 may temporarily prevent exploitation if updates cannot be deployed immediately.
Challenging too warned that WordPress security updates cannot fix the problem because they affect the underlying web server.
Apache HTTP Server 2.4.71 also fixes two other vulnerabilities: CVE-2026-106023, a significant issue that could crash server processes, and CVE-2026-109163, a low-severity stack buffer overflow.
Related: Hackers target N-central Zero-Days as N-able rushes to patches
Related: Attacker targets 60,000 GitHub repositories in credential theft campaign
Related: Critical Red Hat Quay vulnerability could expose private container images
