GoKawiilApache HTTP Server patches critical mod_http2 RCE bug, CVE-2026-119618
The Apache Software Foundation has released a fix for a critical flaw in the mod_http2 module of Apache HTTP Server, tracked as CVE-2026-119618. The bug, a race condition that can corrupt heap memory, affects HTTP Server versions 2.4.55 through 2.4.70 and standalone mod_h2 versions 2.0.8 through 2.0.42, and could let an unauthenticated attacker run arbitrary code with the web server's privileges. It was discovered by Anthropic's OSS Scanner and Google Cloud's Vulnerability Research team.
GoKawiil's interpretation of the reporting above, not reported fact.
Apache HTTP Server runs roughly one in five websites, so an unauthenticated remote code execution flaw in one of its modules carries broad exposure if left unpatched. Wiz telemetry found 64% of cloud environments contain vulnerable resources, with about half publicly reachable, though exploitation requires HTTP/2 to be enabled, which is off by default. watchTowr's advice to 'patch now or drop h2' suggests administrators who can't immediately update may need to disable the protocol as a stopgap.
- CVE-2026-119618 is a critical race-condition bug in Apache's mod_http2 module enabling potential RCE.
- Affects HTTP Server 2.4.55–2.4.70 and mod_h2 2.0.8–2.0.42; a patch is now available.
- Exploitation requires HTTP/2 enabled, which is off by default, limiting but not eliminating real-world risk.
Source: bleepingcomputer.com, 2026-11-12
Published there as: “Apache HTTP Server patches critical HTTP/2 remote code execution flaw”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.