Apache HTTP Server 2.4.71 fixes CVE-2026-119618, a critical mod_http2 flaw that can allow remote code execution without authentication. It affects versions 2.4.55 to 2.4.70 with HTTP/2 enabled. If your website, online shop or intranet runs on Apache, have the version checked and updated today; if you can't, disable HTTP/2.
The essentials
- CVE-2026-119618: insufficient synchronisation in mod_http2's assign_headers() function can corrupt heap memory and allow unauthenticated remote code execution. Red Hat rates it CVSS 9.8.
- Affected versions: Apache HTTP Server 2.4.55 to 2.4.70 with mod_http2, plus the standalone mod_h2 module 2.0.8 to 2.0.42.
- Fix: version 2.4.71, released on 11 November 2026, according to BleepingComputer. It also fixes CVE-2026-106023 (mod_md, important) and CVE-2026-109163 (mod_vhost_alias, low).
- Official advisory: Spain's INCIBE-CERT published it on 12 November with severity 5 (critical).
- Discovery: Anthropic's OSS Scanner and Google Cloud Vulnerability Research (Anthony Weems and Simon Scannell), according to SecurityWeek.
Does it affect me if a provider manages my website?
Yes, it can. Apache is a very widely used web server. It doesn't matter whether your website, online shop, intranet or application server sits in your office, on shared hosting or on a managed server: if it runs a vulnerable Apache version, the risk is the same.
The key condition is HTTP/2. Red Hat says only servers with HTTP/2 enabled are affected; servers that only serve HTTP/1.1 are not. HTTP/2 is enabled through the Protocols directive (values h2 or h2c), either server-wide or for a specific virtual host. So it has to be checked in both places.
One point that causes confusion: updating WordPress or any other CMS doesn't fix this. The flaw is in the web server, not the application.
Is it being exploited already?
The sources disagree. INCIBE-CERT marks it as not exploited. Wiz detected no public exploit or active exploitation on 11 November. Red Hat, however, states that public research has demonstrated a reliable exploit.
What does exist is a proof of concept on GitHub. It reproduces the memory corruption and crashes the process, though it doesn't demonstrate remote code execution. In plain terms: someone can take your website down today with public tools.
Is there a patch for my Linux distribution?
It depends which one you use. Red Hat has already released fixes for RHEL 9 and 10, where it rates the flaw as Important. RHEL 8 and earlier don't contain the vulnerable code.
According to The Hacker News, Debian bookworm, trixie and forky were listed as vulnerable with no patch listed, and Amazon Linux was pending a fix. If you use any of them, check whether the package is available before closing the issue.
What to do today
- List everything that serves web content in your company: corporate site, shop, intranet, application servers, hosting and managed servers. Include the ones you run for clients.
- Ask your IT person or hosting provider to confirm the Apache version. Anything from 2.4.55 to 2.4.70 is vulnerable.
- Have them check the Protocols directive in the main configuration and in every virtual host. If h2 or h2c appears, HTTP/2 is on.
- Update to Apache 2.4.71 or install your distribution's fixed package. On Debian or Amazon Linux, first check that it exists.
- If you can't update today, set Protocols to http/1.1 as a temporary mitigation and note that it must be reverted after patching.
- Start with internet-facing servers. They are the ones the public proof of concept can crash.
What it means for a small business
Don't wait for clarity on active exploitation. A CVSS of 9.8, no authentication required and a public proof of concept that already causes crashes are enough to treat this as urgent. In the worst case it's code execution on your server; in the best case, your online shop is offline.
The real problem for a small company isn't the patch, which is simple. It's knowing where Apache runs and who is responsible for updating it. Many companies don't know their web server version because it lives on hosting they signed up for years ago. If your provider can't tell you the version and HTTP/2 status today, that tells you something about the provider.
One more point: this flaw was found by tools and researchers from Anthropic and Google. If automated scanners speed up the discovery of flaws, you need an update process that doesn't depend on someone reading the news. If that inventory or process isn't clear, our cybersecurity team can help you sort it out.
Frequently asked questions
If my server only uses HTTP/1.1, am I safe from this flaw?
According to Red Hat, yes: only servers with HTTP/2 enabled are affected. Check the Protocols directive server-wide and in every virtual host to confirm.
Does updating WordPress solve the problem?
No. The flaw is in Apache, the web server. CMS updates don't touch it.
Is disabling HTTP/2 enough?
It's a temporary mitigation. The fix is updating to 2.4.71 or to your distribution's patched package.
Sources
- INCIBE-CERT – Múltiples vulnerabilidades en Apache HTTP Server (INCIBE-2026-860)
- SecurityWeek – Apache Patches Critical HTTP Server RCE Found by Anthropic, Google
- The Hacker News – Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
- BleepingComputer – Apache HTTP Server patches critical HTTP/2 remote code execution flaw
