Apache has patched a critical HTTP Server vulnerability that could allow unauthenticated remote code execution (RCE), following independent discoveries by Anthropic and Google researchers.
Tracked as CVE-2026-119618, the flaw affects Apache HTTP Server versions 2.4.55 through 2.4.70. The issue was addressed on November 11 with the release of version 2.4.71. It resides in mod_http2, the module responsible for handling HTTP/2 traffic.
The vulnerability involves a race condition in which multiple threads improperly access shared resources, potentially corrupting server memory.
According to Red Hat, an attacker could exploit the issue remotely without authentication to execute arbitrary commands and gain control of the server process. Red Hat assigned the vulnerability a CVSS score of 9.8 and explained that “only servers that have HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable.”
Apache credited Anthropic’s OSS Scanner with reporting the flaw on October 26. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research independently reported the same vulnerability on November 3.
Cloud security firm Wiz reported that 64% of cloud environments in its data contained resources running affected Apache versions, while 51% had publicly exposed instances. The company cautioned that these figures do not account for server configuration, so they do not necessarily represent exploitable installations.
Red Hat says public research has demonstrated a reliable exploit against a server with mod_http2 enabled, but its advisory does not identify the research.
Wiz noted that when its blog was published on November 11, no exploit was available and there were no reports of exploitation in the wild.
A publicly available proof of concept (PoC) on GitHub reports reproducing memory corruption and Apache process crashes, but does not demonstrate remote code execution.
Organizations are advised to install Apache HTTP Server 2.4.71 or vendor-supplied packages. Disabling HTTP/2 can temporarily prevent exploitation if updates cannot be deployed immediately.
Defiant also warned that WordPress security updates cannot resolve the issue because it affects the underlying web server.
Apache HTTP Server 2.4.71 also fixes two other vulnerabilities: CVE-2026-106023, an important issue that can crash server processes, and CVE-2026-109163, a low-severity stack buffer overflow.
Related: Hackers Target N-central Zero-Days as N-able Rushes Patches
Related: Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign
Related: Critical Red Hat Quay Vulnerability Could Expose Private Container Images
