Unauthenticated attackers can exploit a race condition in mod_http2 (CVE-2026-119618) via standard HTTP/2 traffic; administrators are urged to upgrade to 2.4.71 immediately.
On November 11, 2026, the Apache Software Foundation released Apache HTTP Server 2.4.71, fixing a critical race condition in the HTTP/2 module (mod_http2). Concurrent HTTP/2 requests can corrupt heap memory on the server, allowing a remote, unauthenticated attacker to execute code with the privileges of the httpd process.
What is Apache HTTP Server?
Apache HTTP Server (httpd) is one of the most widely deployed web servers in the world, powering a large share of public websites, reverse proxies and application gateways. Its mod_http2 module provides HTTP/2 support, which is enabled on many production deployments.
Because the flaw is reachable through ordinary HTTP/2 traffic, any internet-facing server with HTTP/2 enabled on an affected version is exposed.
Affected versions
| Package | CVE | Component | Versions | Fixed Versions | Ecosystem |
| httpd | CVE-2026-119618 | mod_http2 (assign_headers()) | 2.4.55 – 2.4.70 | 2.4.71 | Apache HTTP Server |
| mod_h2 | CVE-2026-119618 | assign_headers() | 2.0.8 – 2.0.42 | No fix (repo archived) – use httpd 2.4.71 | mod_h2 (GitHub) |
Recommendations
- Upgrade now. Apache HTTP Server 2.4.71, or your Linux distribution’s backported package as soon as it is available.
- Can’t upgrade yet? Disable HTTP/2. If HTTP/2 is not required, disable mod_http2 (and proxy_http2) so the server falls back to HTTP/1.1.
