Apache httpd 2.4.71 Fixes a Critical mod_http2 Flaw That Can Lead to Code Execution

A race condition in assign_headers() inside mod_http2 can lead to remote code execution on Apache HTTP Server 2.4.55 through 2.4.70, according to the project's security page. The fix shipped on Wednesday, November 11, 2026, in version 2.4.71, and the project rates the flaw Critical. Servers that have mod_http2 loaded and do not use it are the quickest to fix: unload the module or upgrade.

The entry for CVE-2026-119618 describes a "Concurrent Execution using Shared Resource with Improper Synchronization" weakness. The Apache page gives a severity word and no CVSS vector, so the preconditions an attacker needs are absent there. It also does not say whether anyone has exploited the bug.

What is affected and what is fixed

The httpd range is 2.4.55 through 2.4.70. The standalone mod_h2 releases from GitHub are affected from 2.0.8 through 2.0.42. The download page lists 2.4.71, dated 2026-11-11, as the current stable release.

The same release closes two other bugs. Apache rates CVE-2026-106023, a NULL pointer dereference in mod_md that crashes a child process, Important. CVE-2026-109163, a one-byte stack overwrite in mod_vhost_alias, is rated Low.

CVE	Module	Severity	Affected httpd
CVE-2026-119618	mod_http2	Critical	2.4.55 to 2.4.70
CVE-2026-106023	mod_md	Important	2.4.30 to 2.4.70
CVE-2026-109163	mod_vhost_alias	Low	2.4.69 to 2.4.70

The timeline

The Apache entry credits two finders: "Anthropic's OSS Scanner", tracked internally as ANT-2026-MAPKT6MZ, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research. The dates on the page run as follows.

• 2026-10-26: reported to Anthropic's security team.
• 2026-11-03: reported to Google's security team.
• 2026-11-11: fix committed to the 2.4.x branch (commit 824beab) and 2.4.71 released.

That is 16 days from the first report to a patched release. The page does not say whether the two reports reached the Apache project together or separately. Anthropic's tooling also appears in the site's earlier coverage of VulnCheck's count of Anthropic-discovered CVEs.

The fourth mod_http2 entry of 2026

This is not the first memory-safety problem in the HTTP/2 module in 2026. On the same page, CVE-2026-23918, a double free in mod_http2 with possible code execution, is rated Important and was fixed in 2.4.67 on 2026-05-04. Security Affairs put its CVSS score at 8.8 and reported that a working proof of concept existed, that the prefork MPM was not affected, and that code execution was most plausible where APR uses mmap, as on Debian and the official Docker images. It reported no exploitation in the wild.

The MS-ISAC advisory for that earlier bug, issued 2026-05-06, rated it High for large and medium government bodies and businesses. Whether the same preconditions apply to the new flaw is absent from the Apache page.

Two more mod_http2 entries sit between them: CVE-2026-49975, a denial of service rated Moderate and fixed in 2.4.68 on 2026-06-08, and CVE-2026-57941, a use-after-free rated Moderate and fixed in 2.4.69 on 2026-10-01. A reader tracking the OpenSSH bypass the site covered earlier will recognise the pattern of a mature network daemon still producing memory bugs.

1. 2.4.67 (May 4)11 CVEs
2. 2.4.68 (June 8)13 CVEs
3. 2.4.69 (Oct 1)20 CVEs
4. 2.4.71 (Nov 11)3 CVEs

Source: Apache HTTP Server 2.4 vulnerabilities page, accessed 2026-11-11

What to do

Upgrade to 2.4.71. Operators who build mod_h2 separately from GitHub should move past 2.0.42, the last release the page lists as affected. Distribution packages usually lag the upstream tarball, so check the vendor's advisory before assuming a patched package exists. Where an upgrade has to wait, a server that serves no HTTP/2 traffic can remove h2 from its Protocols directive and unload the module.

The next scheduled signal is the distributions' own advisories, which should appear in the days after November 11.