On November 11, Apache released a new version of its web server, Apache HTTP Server 2.4.71. The main reason is CVE-2026-119618, a flaw in the mod_http2 module. Apache rates it critical, and Red Hat gives it a CVSS score of 9.8. While HTTP/2 request headers are being processed, two threads can end up writing to the same memory, which can corrupt the heap and open the door to remote code execution. The attacker needs no account and no action from a user.
Versions 2.4.55 through 2.4.70 are affected, but only when HTTP/2 is enabled, meaning h2 or h2c appears in the Protocols directive. The bug was found independently twice: by Anthropic's open source scanner on October 26 and by Google Cloud researchers on November 3. There are no reports of attacks in the wild yet, but according to Red Hat a reliable exploit against a default configuration has already been demonstrated.
The new release also fixes two smaller issues: a bug in mod_md that can crash a child process, and a low-severity flaw in mod_vhost_alias.
Linux distributions are not all in the same place. Debian 13 already has a fix (DSA-6620-1), while Debian 12 was still waiting as of November 12. RHEL 9 and 10 are affected, with fixed packages not yet published. RHEL 8 is not affected. Ubuntu has not published an advisory yet either.
What to do? First check whether HTTP/2 is actually in use: apachectl -M | grep http2 and the Protocols lines in your configuration will tell you. If your distribution has shipped a fix, update the package and restart Apache. If it has not, temporarily remove h2 and h2c from Protocols or disable mod_http2. Before you do, make sure nothing depends on HTTP/2, such as a gRPC back end.
Sources: Cloud Security Alliance, Cybersecurity News.
