Security · High impactFan score 67 · Tier A6 sources195 comments in the community

Apache HTTP Server patches critical HTTP/2 remote code execution flaw

BleepingComputer · By Bill Toulas · 1d ago

The Brief · written from 6 sources

Apache HTTP Server 2.4.55 through 2.4.70 has a critical mod_http2 flaw (CVE-2026-119618) in assign_headers() caused by improper synchronization, which can lead to heap corruption.
Sources say an unauthenticated remote attacker could exploit it to execute code on servers with HTTP/2 enabled.
Version 2.4.71 fixes the flaw and was released on 2026-11-11; sources say no exploit is available and there are no reports of exploitation in the wild.

Why it matters

Any server running an affected Apache version with HTTP/2 enabled may be remotely exploitable without credentials, so teams need to patch to 2.4.71 or disable mod_http2 quickly.

Who’s affected

Teams running Apache HTTP Server 2.4.55 through 2.4.70
Operators with HTTP/2 enabled on Apache

What to do

Upgrade Apache HTTP Server to version 2.4.71 or later
If patching is not immediately possible, disable HTTP/2 (mod_http2) as a mitigation
Check whether HTTP/2 is enabled on your Apache servers and which version they run

Apache HTTP Server 2.4.55 to 2.4.70 (affected)
Apache HTTP Server 2.4.71 (fixed)
CVE-2026-119618
#apache
#http2
#rce
#vulnerability
#web-server
#cve-2026-119618

A critical vulnerability in the HTTP/2 module of Apache HTTP Server could be exploited by an unauthenticated attacker to obtain remote code execution (RCE). [...]

Read the full story at bleepingcomputer.com ↗

What developers are saying

Based on 195 comments · Mixed reactions

Commenters on Hacker News were skeptical of the severity wording, questioning how memory corruption maps to RCE and whether the Wiz exposure statistics are meaningful. Others confirmed that disabling HTTP/2 is an effective mitigation and noted that many Apache installations use prefork and may not be affected. Several commenters also debated whether AI-assisted discovery and the complexity of HTTP/2 make this class of bug more likely.

Memory corruption versus RCE20%
Disabling HTTP/2 as mitigation25%
AI-assisted vulnerability discovery20%
HTTP/2 complexity and risk15%
Exposure statistics questioned10%

In favour

+ Disabling HTTP/2 is an effective mitigation, according to one commenter who tested it
+ Servers using mpm_prefork may be unaffected, per one commenter