The Apache Software Foundation released Apache HTTP Server 2.4.71 on November 11, 2026, fixing CVE-2026-119618, a critical flaw in mod_http2, the module that provides HTTP/2. Apache describes it as heap corruption and remote code execution in the assign_headers() function, caused by a race condition (CWE-362, concurrent use of a shared resource without proper synchronization). The flaw affects 2.4.55 through 2.4.70, and standalone mod_h2 from GitHub 2.0.8 through 2.0.42. Only servers with HTTP/2 turned on are exposed. A server that speaks only HTTP/1.1 does not run the vulnerable code. Apache has published no CVSS score, and NVD has not analyzed the CVE yet. Red Hat scores it 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and states that “public research has demonstrated a reliable exploit” against a server in its default configuration with mod_http2 enabled. Neither Apache nor CISA reports attacks, and the CVE is not in CISA’s Known Exploited Vulnerabilities catalog. The fix is a one-line public commit, so treat exploitation as a matter of time. Apache credits Anthropic’s OSS Scanner (report ANT-2026-MAPKT6MZ) and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research, who reported it separately. CVE CVSS EPSS CISA KEV Fixed in CVE-2026-119618 9.8 Critical (Red Hat, v3.1) 0.4% No Apache HTTP Server 2.4.71, or the fixed mod_http2 package from your distribution CVSS and EPSS from NVD and FIRST, exploitation status from the CISA Known Exploited Vulnerabilities catalog, checked November 13, 2026. Who is affected A server is exposed when both of these are true: It runs Apache HTTP Server 2.4.55 through 2.4.70, or a build that bundles mod_h2 2.0.8 through 2.0.42. HTTP/2 is enabled. That means mod_http2 is loaded and a Protocols directive lists h2 (HTTP/2 over TLS) or h2c (HTTP/2 over cleartext). Apache’s default is Protocols http/1.1, so HTTP/2 is something an administrator, a distribution package or a control panel turned on. In priority order: Internet-facing web servers and reverse proxies on affected versions with h2 enabled. HTTP/2 is a common performance setting, so assume it is on until you have checked. Apache bundled in other products: hosting control panels, appliances, application stacks and container images that carry their own httpd. Red Hat lists JBoss Core Services and its hardened container images as affected. Internal servers with HTTP/2 enabled. An attacker already inside the network can use the flaw to move sideways. Not affected, according to the vendors: Servers that serve only HTTP/1.1. Apache HTTP Server 2.4.54 and earlier, and mod_http2 before 2.0.8, which do not contain the affected code. Those releases carry other unpatched flaws, so this is no reason to stay on them. Red Hat Enterprise Linux 8 and earlier. Red Hat rates the flaw Important instead of Critical on Red Hat Enterprise Linux 9 and 10. Their mod_http2 packages give each HTTP/2 stream its own memory allocator, which Red Hat says makes the flaw much harder to exploit. Patch them anyway. A CDN or load balancer that terminates HTTP/2 and forwards HTTP/1.1 to the origin keeps the vulnerable code out of reach only if clients cannot connect to the origin directly. What the flaw is HTTP/2 lets a client send many requests at once over one connection. mod_http2 handles the connection on one thread and hands each request (a stream) to a separate pool of worker threads. When a worker starts a request, assign_headers() copies the request’s headers into a table of its own. In one case it then wrote to the wrong table. If the request had a Content-Type header, no Content-Length and no body, the function added Content-Length: 0 to the original headers table that belongs to the connection, in place of the worker’s private copy. Those tables are not built for use by two threads at once. A write from the worker can collide with the connection thread working in the same memory, and the heap is corrupted. Red Hat describes the same root cause: a worker thread writing into memory that the connection thread owns, through an allocator the two share without a lock. With the right timing, an attacker turns that corruption into code execution. No login and no user action are needed. The attacker only has to open an HTTP/2 connection and send requests. The fix, commit 824beab in the 2.4.x branch, changes one line so the header is written to the request’s own table. What an attacker gets. Code runs inside an httpd child process, as the account set by the User directive, usually www-data or apache. From there an attacker can read whatever the web server can read: application code and configuration, database passwords, session data and files in the web root. TLS private keys sit in the memory of the server’s processes, so plan to replace them after a confirmed compromise. Root access needs a second flaw or a weak local configuration. Apache 2.4.71 also fixes CVE-2026-106023 (important), a crash in mod_md that affects 2.4.30 through 2.4.70, and CVE-2026-109163 (low), a one-byte stack overwrite in mod_vhost_alias that affects 2.4.69 and 2.4.70. What to do now Find every Apache server with HTTP/2 on. Use the checks in the next section, starting with anything that faces the internet. Install the fix. Built from source or from apache.org: upgrade to 2.4.71. Red Hat Enterprise Linux 9 and 10: update the mod_http2 package. The fix arrives there, in mod_http2-2.0.26-7.el9_9.1 and mod_http2-2.0.29-5.el10_3.1 (RHSA-2026:98981 and RHSA-2026:98978), with separate errata for the extended support streams. The httpd version number does not change. Debian 13 (trixie): apache2 2.4.71-1~deb13u1, from DSA-6620-1. For Debian 12, the security archive carries 2.4.71-1~deb12u1. Check the Debian tracker for its status. Other distributions, control panels and container images: check the vendor’s page for CVE-2026-119618. Many backport the fix without changing the 2.4.x version number. Restart the server after the update. Use a full restart so every child process loads the new module. If you cannot patch today, turn HTTP/2 off. Set Protocols http/1.1 in the main server configuration and in every virtual host that has its own Protocols line, then restart. A Protocols directive inside a virtual host replaces the one in the main server, so a single forgotten virtual host leaves HTTP/2 on. You can also unload the module: a2dismod http2 on Debian and Ubuntu, or comment out the LoadModule http2_module line elsewhere. Sites keep working over HTTP/1.1, a little slower for pages with many small files. This is our recommendation, based on Apache’s documentation of the directive. Confirm from outside that the server no longer offers HTTP/2, using the curl check below. Review logs back to at least November 9, 2026, when the fix became public in Apache’s source repository, for the signs listed under “How to tell if a server was compromised”. How to check your environment Version. The command depends on the platform: httpd -v # Red Hat family, source builds apache2 -v # Debian and Ubuntu apachectl -v # most platforms rpm -q httpd mod_http2 # Red Hat family packages dpkg -l apache2 # Debian and Ubuntu package On distributions that backport fixes, compare the package version with the vendor’s advisory. The version string from httpd -v can still show an old 2.4.x number on a patched server. Is mod_http2 loaded. apachectl -M 2>/dev/null | grep -i http2 # http2_module (shared) means the module is loaded Is HTTP/2 enabled. Search the configuration for Protocols lines: grep -RinE '^\s*Protocols\b' /etc/httpd /etc/apache2 /usr/local/apache2/conf 2>/dev/null Any line that lists h2 or h2c turns HTTP/2 on for that server or virtual host. No Protocols line at all means HTTP/1.1 only. What the server offers on the wire. This is the check that counts, because it tests the running server: # HTTP/2 over TLS: prints 2 if the server negotiated HTTP/2, 1.1 if not curl -sk -o /dev/null -w '%{http_version}\n' --http2 https://www.example.com/ # HTTP/2 over cleartext (h2c) curl -s -o /dev/null -w '%{http_version}\n' --http2-prior-knowledge http://www.example.com/ Run it against the origin server’s own address as well as the public name. If a CDN or load balancer sits in front, the public name tells you about the CDN, not about Apache. On Windows, run httpd.exe -v and httpd.exe -M from the Apache bin folder, and search conf\httpd.conf and the files it includes for Protocols. Across a fleet, use your vulnerability scanner or software inventory to list hosts with Apache HTTP Server 2.4.55 through 2.4.70, then run the curl check against each one. Hunt 1 below does the inventory step in Microsoft Defender. Free SOC trialWant this watched across your environment without building the hunts yourself? Our 24x7 SOC monitors your endpoints, servers and cloud during a free trial.Start a free trialThreat hunting No indicators of compromise have been published. These hunts find exposed servers, the crashes that failed exploit attempts leave behind, and what an attacker does after getting code execution as the web server account. Example KQL for Microsoft Sentinel and Defender The KQL below is example code for Microsoft Sentinel and Microsoft Defender for Endpoint. Adapt table and field names to your environment and test each query before relying on it. Hunt 1: servers running an affected Apache version // Example: Defender XDR, devices Defender flags for CVE-2026-119618 DeviceTvmSoftwareVulnerabilities | where CveId == "CVE-2026-119618" | summarize Devices = dcount(DeviceId), Sample = make_set(DeviceName, 20) by SoftwareVendor, SoftwareName, SoftwareVersion | order by Devices desc If Defender has not mapped the CVE to your packages yet, list Apache versions from the software inventory: // Example: Defender XDR, Apache HTTP Server versions in the software inventory DeviceTvmSoftwareInventory | where SoftwareName has_any ("http_server", "httpd", "apache2", "mod_http2") | summarize Devices = dcount(DeviceId), Sample = make_set(DeviceName, 20) by SoftwareVendor, SoftwareName, SoftwareVersion | order by SoftwareName asc, SoftwareVersion asc Neither query knows whether HTTP/2 is enabled. Confirm that on each host. Hunt 2: Apache child processes that crash Memory corruption that misses its target kills the child process. Apache records it in the error log as AH00052: child pid 1234 exit signal Segmentation fault (11), or AH00051 when a core file was written. A run of these on a server that was stable before is the earliest sign of exploit attempts. If Apache’s error log goes to syslog, or the kernel log is collected: // Example: Sentinel, Apache child crashes in syslog and kernel messages Syslog | where TimeGenerated > ago(14d) | where (ProcessName in~ ("httpd", "apache2") and SyslogMessage has_any ("AH00052", "AH00051", "exit signal")) or (SyslogMessage has "segfault" and SyslogMessage has_any ("httpd", "apache2")) or (SyslogMessage has_any ("malloc(): ", "free(): invalid", "double free or corruption", "corrupted size") and SyslogMessage has_any ("httpd", "apache2")) | summarize Crashes = count(), First = min(TimeGenerated), Last = max(TimeGenerated), Sample = take_any(SyslogMessage) by Computer, bin(TimeGenerated, 1h) | order by Crashes desc If you collect the Apache log files into a custom table, search the raw lines. The table name here is the one the Microsoft Sentinel Apache HTTP Server solution uses: // Example: Sentinel, crash lines in collected Apache error logs ApacheHTTPServer_CL | where TimeGenerated > ago(14d) | where RawData has_any ("AH00052", "AH00051", "exit signal Segmentation fault", "exit signal Aborted", "exit signal Bus error") | summarize Crashes = count(), First = min(TimeGenerated), Last = max(TimeGenerated) by Computer, bin(TimeGenerated, 1h) | order by Crashes desc Compare the crash times with the access log. Look for one client address that opened HTTP/2 connections and sent bursts of requests in the same minutes. Hunt 3: the web server starting shells and tools After code execution, the attacker works as the web server account. Apache child processes rarely start shells or download tools. // Example: Defender XDR, shells and download tools started by Apache on Linux and Windows DeviceProcessEvents | where Timestamp > ago(14d) | where InitiatingProcessFileName in~ ("httpd", "apache2", "httpd.exe") | where FileName in~ ("sh", "bash", "dash", "ash", "zsh", "curl", "wget", "nc", "ncat", "socat", "python", "python3", "perl", "php", "base64", "chmod", "crontab", "cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "bitsadmin.exe", "whoami.exe") | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine | order by Timestamp desc Servers that run CGI scripts or piped log programs will show normal hits. Baseline each server, then look for commands that are new since November 9. Hunt 4: files written by the web server process // Example: Defender XDR, scripts and binaries created by Apache, and files it drops in temp folders DeviceFileEvents | where Timestamp > ago(14d) | where ActionType == "FileCreated" | where InitiatingProcessFileName in~ ("httpd", "apache2", "httpd.exe") | where FileName matches regex @"(?i)\.(php\d?|phtml|jsp|cgi|pl|py|sh|so|elf|exe|dll)$" or FolderPath startswith "/tmp/" or FolderPath startswith "/var/tmp/" or FolderPath startswith "/dev/shm/" | project Timestamp, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessAccountName, InitiatingProcessCommandLine | order by Timestamp desc Upload features in web applications write files this way too. Check the path and the file type against what the application is meant to store. Hunt 5: outbound connections from the web server A web server answers connections. It seldom opens new ones to the internet, apart from reverse proxy backends and a few known services. // Example: Defender XDR, public addresses the Apache process connected to, rarest first DeviceNetworkEvents | where Timestamp > ago(14d) | where ActionType == "ConnectionSuccess" and RemoteIPType == "Public" | where InitiatingProcessFileName in~ ("httpd", "apache2", "httpd.exe") | summarize Connections = count(), Devices = dcount(DeviceId), First = min(Timestamp), Last = max(Timestamp) by RemoteIP, RemotePort, DeviceName | order by Connections asc Hunt 6: new persistence for the web server account // Example: Defender XDR, cron, SSH key and startup changes made by the web server account DeviceFileEvents | where Timestamp > ago(14d) | where InitiatingProcessAccountName in~ ("www-data", "apache", "httpd", "daemon") | where FolderPath has_any ("/cron", "/.ssh/", "/etc/systemd/", "/.config/autostart", "/etc/ld.so.preload") or FileName in~ ("authorized_keys", ".bashrc", ".profile") | project Timestamp, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine | order by Timestamp desc How to tell if a server was compromised Exploitation happens in memory and leaves no file of its own. Look for what surrounds it: Child crashes. AH00052 or AH00051 lines with Segmentation fault, Aborted or Bus error in the Apache error log, glibc messages such as malloc(): corrupted or double free or corruption, and kernel segfault lines that name httpd or apache2 (Hunt 2). Crashes followed by silence can mean the attempts stopped, or that one of them worked. HTTP/2 bursts from one client. In the access log, many requests from a single address within seconds, logged as HTTP/2.0, around the crash times. To see more, add %{HTTP2}e and %{H2_STREAM_ID}e to your LogFormat. mod_http2 sets these for each HTTP/2 request. Processes under Apache. Shells, interpreters or download tools whose parent is httpd or apache2 (Hunt 3). On the host, ps -ef --forest shows the tree. New files. Scripts in the web root, binaries in /tmp, /var/tmp or /dev/shm, owned by the web server account (Hunt 4). Outbound connections from the web server to addresses it has no reason to reach (Hunt 5). Persistence. A crontab for www-data or apache, new SSH keys, changed startup files (Hunt 6). If you find any of these, isolate the server, keep the logs and a memory image if you can, and rebuild from a known good image on a fixed version. Then replace every secret the web server could read: database and API credentials in application configuration, session signing keys and the TLS private keys. Timeline October 26, 2026: Anthropic’s OSS Scanner reports the flaw to the Apache security team as ANT-2026-MAPKT6MZ. October 30, 2026: CVE-2026-119618 is reserved. November 3, 2026: Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research report it separately. November 9, 2026: The one-line fix is committed to Apache’s public source repository, in trunk and in the 2.4.x branch. November 11, 2026: Apache releases 2.4.71 and announces the CVE. Red Hat publishes mod_http2 updates for Red Hat Enterprise Linux 9 and 10, and Debian publishes DSA-6620-1. Frequently Asked Questions Is CVE-2026-119618 being exploited? Apache and CISA report no attacks, and the CVE is not in the Known Exploited Vulnerabilities catalog. Red Hat says public research has demonstrated a reliable exploit, and the fix is public, so working exploits in other hands are likely to follow. Which Apache versions are affected, and which version fixes it? Apache HTTP Server 2.4.55 through 2.4.70, and standalone mod_h2 2.0.8 through 2.0.42. The fix is in 2.4.71. Distributions ship it as package updates that may keep an older version number. Is my server vulnerable if HTTP/2 is off? No. The vulnerable code is in mod_http2 and only runs for HTTP/2 connections. A server whose Protocols setting is the default http/1.1, or that does not load mod_http2, is not exposed to this CVE. How do I disable HTTP/2 in Apache? Set Protocols http/1.1 in the main configuration and in every virtual host that has its own Protocols line, or unload mod_http2, then restart Apache. Check from outside with curl --http2 that the server now answers with HTTP/1.1. Does a WAF or CDN protect the server? Only if it terminates HTTP/2 itself, talks HTTP/1.1 to Apache, and nobody can reach Apache directly. Apache has published no request signature to block. Treat a proxy in front as a reduction in exposure, and patch the origin. Why does httpd -v still show an old version after I patched? Red Hat, Debian and other distributions backport security fixes into their own package versions. On Red Hat Enterprise Linux 9 and 10 the fix is in the mod_http2 package, so compare rpm -q mod_http2 with the Red Hat advisory. Does the attacker get root? Not from this flaw alone. Code runs as the web server account, such as www-data or apache. That account can read application code, configuration and credentials, and it is a foothold for a local privilege escalation. Is nginx or another web server affected? No. The flaw is in Apache’s mod_http2 code. Other HTTP/2 servers are not affected by CVE-2026-119618. How ThreatDefence is responding ThreatDefence has added CVE-2026-119618 and the fixed versions to our vulnerability intelligence. Across all monitored environments, our SOC is: identifying Apache HTTP Server on affected versions, starting with servers that face the internet alerting on Apache child process crashes, and on shells, download tools and new files that come from the web server process watching web servers for outbound connections to new addresses and for persistence under the web server account If you want help finding exposed servers or checking one for compromise, contact us. Read more about our managed detection and response. Sources Apache HTTP Server Project, Apache HTTP Server 2.4 vulnerabilities: fixed in 2.4.71 (November 11, 2026) Apache HTTP Server Project, 2.4.71 release announcement (November 11, 2026) Apache HTTP Server Project, CHANGES for 2.4.71 Apache HTTP Server source, commit 824beab: mod_http2 assign_headers update table oss-security, CVE-2026-119618 announcement from the Apache security team (November 11, 2026) CVE.org, CVE-2026-119618 NVD, CVE-2026-119618 Red Hat, CVE-2026-119618 Debian Security Tracker, CVE-2026-119618 and DSA-6620-1 CISA, Known Exploited Vulnerabilities catalog Apache HTTP Server documentation, Protocols directive Apache HTTP Server documentation, mod_http2 Apache HTTP Server documentation, HTTP/2 guide Microsoft Learn, DeviceTvmSoftwareVulnerabilities table (Defender XDR advanced hunting)