Apache Patches Critical HTTP/2 Flaw Allowing Remote Code Execution on Web Servers

Apache has fixed a critical bug in its HTTP/2 module that could let a remote attacker run code on a web server. The flaw is tracked as CVE-2026-119618 and affects mod_http2. The fix came on November 11, 2026, in Apache HTTP Server 2.4.71.

The bug sits in a function called assign_headers(). Apache says it is a concurrency problem, where shared resources are used without proper locking.

Put simply, two parts of the code can touch the same piece of memory at the same time. That can damage the heap, the memory area a program uses while it runs, and this can lead to remote code execution.

Apache’s own impact scale reserves the “Critical” label for bugs that a remote attacker could use to run code on a server. These are the kind of bugs that could spread on their own, like a worm.

The CVE entry is still marked as reserved, so there is no public CVSS score or detailed technical write-up yet. Admins should not wait for those details before patching.

Apache HTTP Server versions 2.4.55 through 2.4.70 are affected. People who run the standalone mod_h2 from GitHub should check versions 2.0.8 through 2.0.42. Servers that serve HTTP/2 traffic are the main concern, since the flaw lives in that module.

Anthropic’s OSS Scanner found the flaw and reported it to the Apache security team on October 26, 2026. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported it on their own on November 3.

Apache Patches Critical HTTP/2 Flaw

Apache released the fix on November 11, about two weeks after the first report. Two teams finding the same bug within days shows how much attention researchers are giving HTTP/2 code.

The same release closes two more holes. CVE-2026-106023 is rated “important” and sits in mod_md. A NULL pointer error there can crash a child process while it handles a request, and it affects versions 2.4.30 through 2.4.70.

CVE-2026-109163 is a “low” rated one-byte stack overflow in mod_vhost_alias. It affects only versions 2.4.69 and 2.4.70. This is part of a long run of Apache fixes this year.

Version 2.4.69 in October fixed 20 CVEs, and 2.4.68 in June fixed 13. Cyber Security News covered the October update in its report on multiple Apache HTTP Server flaws that could enable code execution.

HTTP/2 has been a weak spot too. In June, the “HTTP/2 Bomb” denial-of-service exploit hit the default HTTP/2 setups of several popular web servers, including Apache.

Many admins who patched in October now have to patch again, only weeks later. That is tiring, but this bug is serious enough to justify it.

The best step is to upgrade to Apache HTTP Server 2.4.71 as soon as you can. Start with public-facing servers that have HTTP/2 turned on.

Many Linux distributions ship security fixes without changing the version number, so check your vendor’s advisory and package changelog before assuming a server is still exposed.

Apache has not listed a workaround for this flaw. If you cannot upgrade right away, one option is to limit the server to HTTP/1.1 until the update is done.

Test that change first, because it can affect performance and clients. Also watch your logs for unusual crashes or worker-process restarts, since these can suggest someone is probing the server.

The full list of fixed bugs is on Apache’s security vulnerabilities page. The project explains its severity labels on the impact levels page.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post Apache Patches Critical HTTP/2 Flaw Allowing Remote Code Execution on Web Servers appeared first on Cyber Security News.