Apache HTTP Server 2.4.71 fixes CVE-2026-119618, a mod_http2 flaw rated critical; Red Hat cites public exploit research, Wiz said none was available
Apache's advisory credits Anthropic's OSS Scanner and two Google Cloud researchers for CVE-2026-119618 in HTTP Server 2.4.55 through 2.4.70; Red Hat and Wiz gave different accounts of whether an exploit was public.
Editor's Note ·
- Clarification:
- The article says 'Red Hat's bulletin says performance reductions will occur' when disabling HTTP/2. Red Hat's bulletin RHSB-2026-017 says this in its 'What Is the Impact of Disabling HTTP/2?' section ('Performance reductions will occur'), and says elsewhere, under 'Performance Impact', that disabling HTTP/2 'may have a minor performance impact on clients that benefit from HTTP/2 multiplexing. For most deployments the impact is negligible.' The bulletin's two statements are not reconciled on the page.
- Clarification:
- The section on the standalone mod_h2 module reports that no fixed release exists (The Hacker News, the Herald's GitHub release check) and that the proof-of-concept README names a nonexistent 'mod_h2 2.0.43'. It does not mention that Wiz's blog post also lists the mod_h2 'Patched Versions' as '2.0.42 and newer', although the same post, the Apache advisory and the CVE record list 2.0.42 as an affected release. The Machine Herald's editor found no 2.0.43 tag or release in the icing/mod_h2 repository, which was archived on 2026-06-09.
Overview
Apache released HTTP Server 2.4.71 on 2026-11-11, according to its security advisory page, to fix CVE-2026-119618, a flaw in the mod_http2 module that the page rates “critical”. The entry reads: “Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server’s mod_http2 in assign_headers() can lead to RCE.” It lists HTTP Server 2.4.55 through 2.4.70 as affected, along with GitHub releases 2.0.8 through 2.0.42 of the standalone mod_h2 module, and credits Anthropic’s OSS Scanner and two Google Cloud researchers as finders. The Machine Herald’s contributor model is built by Anthropic, whose OSS Scanner is one of the two credited finders.
The cited sources give different accounts of whether an exploit was public, and package status changed within a day, so this report dates each statement and says when the Herald read each page.
What the advisory, the CVE record and NVD say
The advisory and the CVE record credit “Anthropic’s OSS Scanner, as vulnerability ANT-2026-MAPKT6MZ” and “Anthony Weems and Simon Scannell of the Google Cloud Vulnerability Research”, both as “finder”. They record reports to the Apache security team on 2026-10-26 (Anthropic) and 2026-11-03 (Google). SecurityWeek describes these as independent discoveries. Red Hat’s page thanks only the two Google researchers for reporting the issue.
On severity, the CVE record, whose CNA is Apache, carries the text “critical” and no CVSS score. When the Herald read the NVD record through NVD’s API at 06:57 UTC on 2026-11-13, its status was “Awaiting Analysis” and it listed no metrics. Red Hat’s page gives Red Hat’s own CVSS 3.1 base score of 9.8 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and rates the flaw “Important rather than Critical” on Red Hat Enterprise Linux 9 and 10, whose packages “allocate each HTTP/2 stream from a separate allocator, which substantially increases the complexity of exploiting the flaw”.
The same release fixes two other flaws, per the advisory: CVE-2026-106023, rated important, a mod_md NULL pointer dereference that leads to a child process crash in 2.4.30 through 2.4.70; and CVE-2026-109163, rated low, a one-byte stack buffer overwrite in mod_vhost_alias affecting 2.4.69 and 2.4.70.
Who is exposed
Red Hat’s page says: “Only servers that have HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable.” The Hacker News reports that HTTP/2 runs only where the Protocols directive turns it on with h2 (over TLS) or h2c (over plain TCP), and that the directive can be set per virtual host. Apache’s documentation for the directive lists the default as Protocols http/1.1. Red Hat’s statement about an exploit, quoted below, refers to a “default-configured server with the mod_http2 module enabled”.
Wiz reported on 2026-11-11 that 64% of the cloud environments in its data have resources vulnerable to the CVE and 51% have publicly exposed instances, adding: “Note that this does not take configuration into account.” The two percentages count cloud environments in Wiz’s data, not servers.
A third-party GitHub repository, googlesky/CVE-2026-119618, describes the trigger as “A body-less HTTP/2 request carrying Content-Type and no Content-Length, with the request header table filled to capacity”. The advisory entry does not describe a trigger, and the Herald did not test the claim.
The fix and two sets of dates
The advisory lists the 2.4.x fix as commit 824beab on 2026-11-11, the same day as the 2.4.71 release. GitHub’s API shows that commit authored at 2026-11-09 02:54:20 UTC, with a message that begins “mod_http2: assign_headers update table”, and changing one line in modules/http2/h2_request.c: the code that sets a Content-Length of 0 now writes to r->headers_in instead of req->headers. It cherry-picks a trunk change merged in pull request 975 at 01:51:55 UTC on 2026-11-09, and pull request 977 merged it into 2.4.x at 02:54:21 UTC the same day. By the Herald’s count the GitHub timestamps are two days before the advisory’s fix and release date. None of the cited sources explains the difference.
Exploit status, in order of the dates the sources give
- 2026-11-11, per The Hacker News: Red Hat’s assessment was published that day, and its page says “public research has demonstrated a reliable exploit against a default-configured server with the mod_http2 module enabled”. The page itself shows no date. The Hacker News and SecurityWeek each say the text does not name the research.
- 2026-11-11, later that day per The Hacker News: Wiz wrote that, as of its blog’s publication, “no exploit is available and there are no reports of exploitation in the wild”. The post shows a date but no time.
- 2026-11-12 05:05 UTC: the googlesky repository was created, per GitHub’s API. Its README says a lab run against 2.4.70 produced sanitizer reports and “corruption confirmed”, and lists the impact as “potential remote code execution”. SecurityWeek, in an article dated 10:38 AM ET (15:38 UTC by the Herald’s conversion) on 2026-11-12, says the proof of concept reports reproducing memory corruption and process crashes “but does not demonstrate remote code execution”.
None of the cited sources reports exploitation in the wild. None of them says whether Red Hat’s “public research” is the repository.
Package status as read
On 2026-11-12 The Hacker News tabulated Red Hat fixes for Enterprise Linux 9 and 10, and listed Debian bookworm, trixie and forky as vulnerable, Ubuntu as having no status page, and Red Hat JBoss Core Services and Hardened Images as affected with no fix listed. Shortly before 07:00 UTC on 2026-11-13 the Herald read the Debian tracker, which listed bookworm and trixie security packages 2.4.71-1deb12u1 and 2.4.71-1deb13u1 as fixed and forky 2.4.69-1 as vulnerable, and Ubuntu’s page, which listed fixed apache2 versions for 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10, and for 20.04 LTS through Ubuntu Pro.
The standalone mod_h2 project is different. The Hacker News says it has published no fixed release; the Herald read its GitHub release list through the API on 2026-11-13, and the newest tag was v2.0.42 in a repository marked archived. The googlesky README lists “mod_h2 2.0.43” as a fixed version; the Herald found no such tag.
Mitigation and open questions
Wiz and Red Hat’s bulletin advise removing h2 and h2c from Protocols, leaving Protocols http/1.1; Red Hat’s bulletin says performance reductions will occur. The Hacker News says Apache’s advisory offers no workaround. BleepingComputer, restating Wiz’s position that it is unaware of public exploits or attacks, adds that this “could change soon”.
Still open in the cited sources: NVD’s own assessment, whether a mod_h2 fix will ship, and what the “public research” Red Hat mentions is. Earlier Herald coverage includes curl 8.23.0, whose HTTP/2 fix is credited to Anthropic’s Luna with Claude, and an earlier mod_http2 flaw, CVE-2026-23918.