CVE-2026-119618: Apache HTTP Server RCE and how to patch

TL;DR

• CVSS 3.1: 9.8 (Critical), according to Red Hat’s assessment.
• Patch Apache HTTP Server to 2.4.71 or a vendor package containing the fix. CVE-2026-119618 affects versions 2.4.55 through 2.4.70 and can lead to remote code execution through mod_http2.
• Prioritize reachable HTTP/2 deployments. Inventory results need to be checked against the module and protocol configuration actually in use.
• If patching must wait, disable HTTP/2 on affected listeners and virtual hosts, then verify the change has taken effect.

What is CVE-2026-119618?

Apache rates CVE-2026-119618 as critical. Concurrent execution in mod_http2 can access shared resources without proper synchronization inside assign_headers(), causing heap corruption and potentially remote code execution. Apache security advisory.

Red Hat assigns a CVSS 3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network-accessible exploitation, low attack complexity, no privileges or user interaction required, and high impact to confidentiality, integrity, and availability. Product-specific severity can differ; Red Hat rates its RHEL 9 and 10 builds Important because their allocator design increases exploitation complexity. Red Hat CVSS and product assessment.

Affected Apache HTTP Server versions

Apache published the fix on November 11 and credits Anthropic's OSS Scanner and Google Cloud researchers Anthony Weems and Simon Scannell. Affected versions and disclosure history.

Standalone module users should verify the fix explicitly. The archived icing/mod_h2 repository still lists 2.0.42 as its latest release, and that version is affected. Selecting its latest release is not sufficient remediation. Module releases.

For triage, establish three things for each service: which build is running, whether it loads the affected HTTP/2 module, and whether traffic can reach that module. Include containers, reverse proxies, internal listeners, and origin servers behind a CDN or load balancer. Trace the protocol used on each connection rather than assuming the public endpoint describes the entire path.

How to patch CVE-2026-119618

1. Update the running service. Install Apache HTTP Server 2.4.71 or a distribution package whose advisory confirms the fix. For backported packages, use the vendor's security status rather than the upstream version string alone.
2. Replace affected container images and restart the service. Updating a package or image definition does not replace every running process. Cover all replicas and hosts.
3. Check the deployed result. Confirm the active binary and module came from the patched package. Exercise the service through its normal traffic path and check for errors before completing the rollout.

Prioritize internet-facing services with HTTP/2 enabled, followed by reachable internal deployments. Services with access to sensitive credentials or privileged backend systems warrant particular attention.

Temporary mitigation: disable HTTP/2

To disable HTTP/2 while scheduling the patch, remove h2 and h2c from the applicable protocol configuration so only HTTP/1.1 remains:

Protocols http/1.1

Review virtual-host overrides as well as the global setting. Validate the configuration, apply it through the service's normal restart procedure, and test each affected endpoint to confirm that HTTP/2 is no longer negotiated. Check application compatibility during the change. Apache protocol configuration.

Keep the upgrade scheduled even after applying the mitigation. Record the affected services, the temporary configuration change, and the patched build deployed so the team can verify that every instance has been addressed.