A critical flaw in the HTTP/2 module of Apache HTTP Server, one of the most widely deployed web servers on the internet, can let a remote attacker who needs no login corrupt the server's memory and potentially run code with the web server's privileges. Apache fixed the bug, tracked as CVE-2026-119618, in version 2.4.71, released on November 11, 2026.
The exposure is wide. Wiz researchers report that 64% of cloud environments they can see contain resources vulnerable to the flaw and 51% have publicly exposed instances, though Wiz notes those figures do not take configuration into account. That caveat matters, because only servers that actually speak HTTP/2 are affected.
A timing bug in the code that builds HTTP/2 headers
According to Wiz, the flaw is a race condition in the assign_headers() function of mod_http2, the module Apache uses to serve HTTP/2 requests. A race condition is a timing bug: concurrent threads share a resource without proper synchronization, and an attacker can make them collide. Here, Wiz says, the collision corrupts heap memory, which can be leveraged into arbitrary code execution as the web server process.
Apache lists versions 2.4.55 through 2.4.70 as affected, along with standalone mod_h2 releases 2.0.8 through 2.0.42. Apache's default protocol is HTTP/1.1, so HTTP/2 has to be enabled in the configuration for a server to be exposed, as Wordfence's Alex Thomas points out in guidance for WordPress site owners.
An AI scanner and Google both found it
Two teams reported the bug independently. Apache credits Anthropic's OSS Scanner, which reported it on October 26, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research, who reported it on November 3, according to the timeline Wordfence compiled from Apache's advisory.
There is no confirmed exploitation. Wiz reported no public exploit and no attacks in the wild at the time of its November 11 write-up. Wordfence says a researcher has posted a test setup showing memory corruption and Apache child-process crashes on 2.4.70, but that the public material does not demonstrate remote command execution. Red Hat, Wordfence notes, describes the issue as unauthenticated remote code execution when HTTP/2 is enabled.
Upgrade to 2.4.71, or switch HTTP/2 off for now
- Patch: upgrade Apache HTTP Server to 2.4.71 or later, and move standalone mod_h2 builds past 2.0.42. Distribution, control-panel and container packages may carry the fix under a different version number, so follow your supplier's advisory, and restart Apache after updating.
- Workaround: if you cannot patch yet, remove h2 and h2c from the Protocols directive (leaving Protocols http/1.1), including in virtual hosts. Servers serving only HTTP/1.1 are not affected.
- Check the origin, not the edge: a site can offer HTTP/2 to visitors through a CDN or load balancer while its Apache origin only receives HTTP/1.1. Wordfence notes that AWS Application Load Balancers talk HTTP/1.1 to back-end targets by default.
- Hosted sites: WordPress, plugin and theme updates will not fix this. Ask your host whether its Apache accepts HTTP/2 and whether CVE-2026-119618 has been patched.
For a related round of Apache fixes, see our coverage of Tomcat's September patches. Nothing public yet shows working code execution for this bug, which makes now the cheap moment to patch, before somebody turns a reproducible crash into a reliable foothold.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.