Apache HTTP Server: mod_http2 heap corruption and RCE flaw (CVE-2026-119618) fixed in 2.4.71, exploited in the wild
Published 11/11/2026 19:16 · Updated 11/11/2026 19:18 (revision 2)
Timeline
5 events over 1 h
- 11/11/2026 18:16Corroboratedhttpd.apache.org+0 min
- 11/11/2026 18:16Confirmedhttpd.apache.org+0 min
- 11/11/2026 18:16Exploitedhttpd.apache.org+59 min
- 11/11/2026 19:16Published on WatchtowerPro CISO+1 min
- 11/11/2026 19:18UpdatedThe Apache HTTP Server vendor page now lists the 2.4.71 fix released on 11/11/2026 and…
In short
Apache HTTP Server versions 2.4.55 through 2.4.70 have a critical flaw in the mod_http2 module that can let an attacker run code on the server. The Apache project says it is known to be exploited in the wild. It is fixed in version 2.4.71, released on 11/11/2026, so update as soon as possible. Shodan estimates about 10.3 million internet-facing Apache httpd servers worldwide, 3.2 million of them in the EU (11/11/2026); how many run an affected version is not yet known.
How bad is it
Critical. An attacker could run their own code on a vulnerable Apache web server through its HTTP/2 module, and the vendor says attacks are already happening; whether they need to log in is not stated.
Being exploited.
Severity score
No CVSS score published yet
CVE-2026-119618: no score published yet. A missing score is never read as 0.
What an attacker needs
- Internet access to itNot published yet
- A loginNot published yet
- A user to clickNot published yet
- Special settingsNot published yet
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Apache HTTP Server 2.4.55 through 2.4.70
- mod_h2 from GitHub, 2.0.8 through 2.0.42 (the separate build, not the module bundled in httpd)
Fixed in
- 2.4 branch: 2.4.71
What to do now
- Update Apache HTTP Server to 2.4.71 as soon as your distribution or hosting provider offers it; check your distribution's security tracker (for example Debian) for a patched package, since distributions may fix without changing the upstream version number.
- Check which servers run Apache 2.4.55 to 2.4.70 with mod_http2 loaded, and whether any use the separate mod_h2 build from GitHub (2.0.8 through 2.0.42).
- Because attacks are reported, treat unpatched servers as urgent and look for signs of compromise on exposed ones.
- Interim, not confirmed by the vendor for this CVE: ask your hosting provider to disable mod_http2 or remove h2 and h2c from the Protocols directive so clients fall back to HTTP/1.1. This only reduces exposure and does not make a server safe; the update is still required.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer, all 3 sources with their dates and every revision. And technology matching: which of your systems run Apache httpd, at which version, fixed or not - and what each one needs.
Main sources
Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project Vendor · CVE-2026-119618: Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers Research · CVE-2026-23918 - Red Hat Customer Portal Research