syslog.eu
CS EN DE FR
[CRIT · FIX TODAY]/News·

Apache HTTP Server: critical HTTP/2 flaw can lead to code execution – update to 2.4.71

Apache HTTP Server 2.4.71, released November 11, fixes CVE-2026-119618, rated critical by the project. A race condition in the HTTP/2 module (mod_http2) can corrupt memory and lead to remote code execution in versions 2.4.55 through 2.4.70. Cloud security firm Wiz says exploiting it needs no login, and that no exploit or attacks were known when it published.

Affected apache-httpd
Syslog card, level CRIT (fix today): Apache web server RCE, HTTP/2 flaw; fixed in 2.4.71, no attacks yet. Affected: Apache httpd, HTTP/2, mod_http2. To do: Update Apache to 2.4.71 or distro fix; Turn off HTTP/2 until you can update.

Does this concern you?

  • Affected: servers running Apache httpd 2.4.55 to 2.4.70 where HTTP/2 is enabled (the h2 or h2c protocol), and standalone mod_h2 2.0.8 to 2.0.42 from GitHub.
  • Skip it if: your sites run on nginx, IIS or another web server, upstream Apache is older than 2.4.55, or HTTP/2 is switched off. For distribution packages, go by the distribution's notice, not the version number. If a hosting provider runs the server, the update is theirs; asking about it is yours.

What to do

  • Find every Apache instance you run, containers included. apachectl -v (apache2ctl on Debian and Ubuntu) shows the version; apachectl -M lists http2_module if HTTP/2 is loaded; then search the config for Protocols lines with h2 or h2c.
  • Install 2.4.71 or later. Apache from your Linux distribution: install its security update instead, which may keep an older version number; look for CVE-2026-119618 in the distribution's notice.
  • Standalone mod_h2 from GitHub: move to a release newer than 2.0.42.
  • Cannot update today? Wiz's stopgap: remove h2 and h2c from every Protocols line (main config, distribution config files, each VirtualHost) so only Protocols http/1.1 remains, then restart Apache.
  • Already hit? No attacks are reported, so there are no signs to hunt for yet.
  • If a hosting company runs your Apache, have them confirm the fix is installed.

What we know – and what we don't

  • The Apache project rates the flaw critical and credits two finders: Anthropic's OSS Scanner (reported October 26) and Google Cloud Vulnerability Research (November 3); Wiz says they found it independently.
  • The CVE record has no CVSS score, only "critical"; the weakness is CWE-362 (improper synchronization).
  • Wiz counts affected versions in 64% of the cloud environments it sees and internet-exposed ones in 51%; the count ignores configuration, such as whether HTTP/2 is on.
  • 2.4.71 also fixes two lesser flaws, in mod_md (important) and mod_vhost_alias (low).
  • Not known: how hard the race condition is to win in practice, and whether working exploits will appear.

Why it matters

Apache still runs a great many small company sites, and in our view plenty of them were set up once and rarely touched since. With a one-line switch-off available, an exposed server need not wait for a maintenance window.

Sources

← All news