Apache HTTP Server Critical RCE 2026: Patch Priority

What CVE-2026-119618 actually is

The Apache Software Foundation has fixed CVE-2026-119618, a critical remote code execution vulnerability in the mod_http2 module used to handle HTTP/2 traffic. Apache's release material describes it as 'Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.' The practical effect is that when multiple threads process HTTP/2 traffic at once, a timing clash can scramble heap memory, which can potentially enable arbitrary code execution with the web-server process's privileges when HTTP/2 is enabled.

Credit for finding the bug goes to Anthropic's OSS Scanner and Google Cloud's Vulnerability Research teams, and watchTowr said it separately verified that the exploitation conditions hold, as reported by BleepingComputer and SecurityWeek.

Which versions and configurations are exposed

The bug sits in Apache HTTP Server builds between 2.4.55 and 2.4.70, as well as in standalone mod_h2 releases 2.0.8 to 2.0.42. The fix ships in Apache HTTP Server 2.4.71, released 11 November 2026, according to Apache's official security advisory and CHANGES_2.4.71 documentation.

Crucially, an attacker can only reach the flaw where HTTP/2 support is switched on, and HTTP/2 is disabled by default in the relevant Apache configuration. watchTowr researchers said this precondition genuinely limits exposure, distilling their guidance into one blunt line: 'patch now or drop h2 until you can.' For UK operators, that means the first job is establishing exactly which of your Apache-fronted services actually have HTTP/2 switched on, not assuming the whole fleet is at equal risk.

Why the severity rating matters for UK buyers

Apache itself hasn't issued an official CVSS figure, but Red Hat's advisory puts the flaw at 9.8 out of 10, framing it as an unauthenticated path to full control of the server process. Wiz, working from its own telemetry, independently assesses the issue as critical.

The two assessments of exploitation diverge: Wiz said it was unaware of public exploit code or exploitation in the wild, while Red Hat said public research had demonstrated a reliable exploit against a default mod_http2 setup. For infrastructure teams, that disagreement itself is the cue to act now instead of waiting for confirmed in-the-wild exploitation — a pattern we've repeatedly flagged in our analysis of CVE exploitation timelines.

Scale of exposure across hosting and cloud estates

Telemetry gathered by cloud security firm Wiz shows that vulnerable Apache resources sit inside 64% of cloud environments, and roughly half of those already have instances sitting openly on the internet, BleepingComputer reports.

Shared hosting platforms, reverse-proxy tiers and CDN-origin servers can be especially important environments to assess, because a compromised Apache process could expose data or credentials accessible to that process. Providers running at fleet scale should treat this as a trigger to re-run attack surface management discovery across every public listener, not just the servers they remember configuring with HTTP/2.

The patching and mitigation priority list

The remediation path is straightforward but time-sensitive. Upgrade Apache HTTP Server deployments to the fixed 2.4.71 release, and obtain the vendor's fixed standalone mod_h2 package/version where applicable; restart the affected services, and confirm the update has actually taken across every instance and container image, including base images that may still reference older builds.

Where an immediate upgrade isn't operationally feasible, disable HTTP/2 on the affected listener until patching can be completed, subject to testing for availability and proxy compatibility. As a general defensive detection step, review access and process-execution logs for unexpected child processes or anomalous request patterns in the interim. Treat this as a case study for tightening emergency patch management processes so HTTP/2-capable modules get the same urgency as internet-facing authentication components in future.

• •Inventory every Apache HTTP Server and standalone mod_h2 instance, including containers and base images
• •Confirm whether HTTP/2 is enabled per listener before assuming risk level
• •Upgrade to the fixed Apache HTTP Server release and restart affected services
• •Disable HTTP/2 as a stop-gap where upgrading isn't immediately possible
• •Review logs for unexpected server-process behaviour post-patch

The broader pattern UK providers should plan around

This isn't an isolated event. CVE-2026-119618 follows another 2026 Apache HTTP/2 vulnerability, CVE-2026-23918, a double-free issue with potential for denial of service and RCE in Apache HTTP Server 2.4.66, fixed in 2.4.67. Two significant Apache HTTP/2 vulnerabilities were disclosed in 2026, reinforcing the case for active patch monitoring.

Apache's official 2.4.71 release documentation also notes two lesser issues worth bundling into the same maintenance cycle: CVE-2026-106023, a null pointer dereference inside mod_md, and CVE-2026-109163, a low-severity data overwrite bug in mod_vhost_alias. Providers managing large customer-facing fleets should fold this into broader cyber security services planning, backed by managed detection & response coverage so unusual Apache process behaviour is flagged quickly if a patch window slips.