Apache HTTP Server 2.4.71 fixes a critical mod_http2 flaw that can lead to remote code execution

What happened

The Apache HTTP Server project (httpd) released version 2.4.71 on 11 November 2026. According to the project's security page, it fixes three vulnerabilities: one critical, one important and one low. The most serious is CVE-2026-119618 in mod_http2, the module that implements HTTP/2 in Apache. Apache describes it as "heap corruption and RCE in assign_headers" – a bug that could let an attacker run their own code on the server.

Eric Covener of the Apache project posted the announcement to the oss-security mailing list the same day. The NVD record went live on the afternoon of 11 November, with no CVSS score yet. Apache rates the flaw critical on its own severity scale.

Two teams reported the bug independently: Anthropic's open source scanner (26 October 2026) and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research (3 November 2026). The fix shipped about two weeks after the first report.

Technical details

The bug lives in the assign_headers() function of mod_http2. Apache classifies it as a race condition – "concurrent execution using shared resource with improper synchronization" (CWE-362). HTTP/2 multiplexes many requests over a single connection, and Apache processes them on multiple threads. When two threads touch the same data without proper locking, heap memory can get corrupted. According to Apache, that corruption can lead to remote code execution with the privileges of the httpd worker process.

Neither Apache nor NVD has published further details, exploitation conditions or proof-of-concept code. The description does not mention any need to authenticate – an attacker would apparently only need to open an HTTP/2 connection to the server. Reliably exploiting a race condition tends to be harder than a plain overflow, but don't count on that.

Version 2.4.71 also fixes two other issues:

Who is affected

• Apache HTTP Server 2.4.55 through 2.4.70 with the mod_http2 module loaded and HTTP/2 allowed in the Protocols directive (h2 for HTTPS, h2c for cleartext HTTP).
• The standalone mod_h2 module from GitHub, versions 2.0.8 through 2.0.42. Apache's security page does not say which mod_h2 release contains the fix.

According to the Apache documentation, Protocols defaults to http/1.1 only, so HTTP/2 has to be switched on. Distribution configs, control panels and hosting providers often do exactly that. To check your server (use apache2ctl on Debian and Ubuntu, apachectl or httpd elsewhere):

apache2ctl -v                      # server version
apache2ctl -M | grep -i http2      # is http2_module loaded?
grep -Rni "^\s*Protocols" /etc/apache2/ /etc/httpd/ 2>/dev/null

Your server is exposed if it runs 2.4.55 to 2.4.70, loads http2_module and has Protocols with h2 or h2c somewhere in its config. For distribution packages, go by the vendor's security advisory, not the version number alone. As of 12 November 2026 the Debian Security Tracker lists only sid (2.4.71-1) as fixed; bookworm, trixie and forky are still marked vulnerable.

How to tell if you were compromised

Apache has not published indicators of compromise and does not mention exploitation. A few tips from our own practice:

• Watch error_log for unusual worker crashes (messages like AH00052: child pid … exit signal Segmentation fault), especially repeated ones that coincide with HTTP/2 traffic. Heap corruption often shows up as a crash first.
• Look for new processes running as the web server user (www-data, apache), unknown files in directories it can write to, and new outbound connections from the server.
• Pull suspicious IP addresses and domains out of your logs with our IOC extractor – it runs entirely in your browser.

What to do

1. Upgrade to Apache HTTP Server 2.4.71, or install your distribution's fixed package as soon as it is available. Restart the server afterwards (systemctl restart apache2 or httpd) and confirm the version.
2. If no fix is available yet, consider disabling HTTP/2 temporarily. Change Protocols h2 http/1.1 to Protocols http/1.1 (drop h2c too), or on Debian and Ubuntu disable the module with a2dismod http2. Then run apache2ctl configtest and restart. The site keeps working over HTTP/1.1. This is our own mitigation, based on the bug being in mod_http2 – Apache does not list a workaround.
3. Check proxies and load balancers. If nginx, HAProxy or a CDN sits in front of Apache and talks HTTP/2 (h2 or h2c) to it, Apache is still exposed. Also confirm that Apache cannot be reached directly from the internet.
4. While you're upgrading, you also get the fix for CVE-2026-106023 in mod_md (automatic certificates from Let's Encrypt and other ACME authorities), which can crash a child process.
5. If you find signs of compromise, take the server offline, preserve the logs and report the incident to your national CERT (in the US, CISA; in the UK, the NCSC).

Timeline

Updates

• 12 November 2026 – first version of this article.