threat alerts

Apache HTTP Server – mod_http2 Remote Code Execution (CVE-2026-119618)

A race condition in Apache HTTP Server’s mod_http2 lets an unauthenticated remote attacker corrupt the heap and potentially take control of the server process. Versions 2.4.55 through 2.4.70 are affected when HTTP/2 is enabled, including servers already updated for CVE-2026-23918. Update to 2.4.71 or your distribution’s fixed package, or disable HTTP/2 until you can.

Vulnerability

A critical vulnerability affects the HTTP/2 module (mod_http2) in Apache HTTP Server. Servers with HTTP/2 enabled can be attacked remotely.

The flaw is a race condition. mod_http2 is designed so that worker threads don’t use the connection’s shared memory allocator. Each worker gets a private one instead.

A function in the module, assign_headers(), breaks that rule for one request shape. The request has no body, a Content-Type header and no Content-Length, and arrives when the request header table is full.

In that case, the worker writes a synthesized Content-Length: 0 into the shared stream table. That write races with the connection thread on a lock-free free list.

Two threads can then take the same memory node, which corrupts the heap.

Only servers with HTTP/2 enabled are affected. That means the Protocols directive includes h2 (HTTP/2 over TLS) or h2c (HTTP/2 over plain TCP). The directive can be set server-wide or per virtual host, so both need checking.

CVE and severity

The vulnerability is tracked as CVE-2026-119618.

It’s described as critical, with a CVSS score of 9.8.

Red Hat rates the flaw Critical (9.8) upstream, but Important on Red Hat Enterprise Linux (RHEL) 9 and 10. Red Hat’s mod_http2 packages give each HTTP/2 stream its own memory allocator, which makes an attack much harder.

Impact

A remote attacker who can reach a server with HTTP/2 enabled can exploit the flaw without authentication or user interaction. Successful exploitation can:

  • leave the process holding double-owned memory after the heap is corrupted
  • turn that memory corruption into code execution
  • give the attacker full control of the server process

Wiz reports that 64% of cloud environments have resources running a vulnerable version, and 51% have publicly exposed instances.

Exploit status

For current information on exploitation, see the Apache, Red Hat, Debian and Amazon Linux pages listed under references.

Affected component and versions

Affected:

  • Versions 2.4.55 through 2.4.70, with HTTP/2 enabled through the Protocols directive
  • Standalone mod_h2 builds from GitHub, versions 2.0.8 through 2.0.42

The flaw was fixed on November 11, 2026 in version 2.4.71. That release also fixes an important-rated crash in mod_md and a low-rated one-byte stack overwrite in mod_vhost_alias.

Vendor status as of November 12, 2026:

  • RHEL 9: fixed in mod_http2-2.0.26-7.el9_9.1 (RHSA-2026:98981).
  • RHEL 10: fixed in mod_http2-2.0.29-5.el10_3.1 (RHSA-2026:98978).
  • RHEL 9.4 Update Services for SAP Solutions, and RHEL 9.6, 9.8, 10.0 and 10.2 Extended Update Support: fixed, in RHSA-2026:98968, 98954, 98982, 98953 and 98979.
  • RHEL 6, 7 and 8: not affected.
  • Red Hat JBoss Core Services and Red Hat Hardened Images: affected, with no fix listed.
  • Debian unstable (sid): fixed in apache2 2.4.71-1. Debian bookworm, trixie and forky remain vulnerable, with no fix listed.
  • Amazon Linux 2, Amazon Linux 2023 and Amazon Linux 2027 Preview: fix pending.
  • Ubuntu: no CVE tracker page.

Fix and mitigation

  • Update Apache HTTP Server to 2.4.71 or later, or apply your distribution’s fixed package listed above.
  • Rebuild container images built before November 11, 2026. They’ll contain a vulnerable version.
  • Don’t assume a server updated for CVE-2026-23918 (2.4.67) is protected. Versions 2.4.67 to 2.4.70 are affected by this flaw.
  • Audit both server-wide and per-virtual-host Protocols settings to establish which servers have HTTP/2 enabled and are exposed.
  • Prioritize internet-facing servers. Check whether you’re on a distribution where no fix is available yet, such as Debian stable, JBoss Core Services or Amazon Linux. On those, the Protocols workaround below is the only control.
  • Monitor for unexpected Apache worker process crashes or restarts, and for unusual HTTP/2 requests that carry a Content-Type header but no Content-Length.

If you can’t update right away, disable HTTP/2. Remove h2 and h2c from the Protocols directive and set Protocols http/1.1 in each configuration file and each virtual host block.

The Apache advisory offers no workaround other than this Protocols change, which Wiz recommends. The same change applies to servers running standalone mod_h2 builds.

References

Tags

Related Posts