L3 · ShartedApache HTTP Server · HTTP/2 · RCEapache-httpd-2471-security

Apache HTTP Server 2.4.71 fixes an HTTP/2 heap corruption flaw

Apache fixed a race in mod_http2 that can allow remote code execution. Upstream httpd 2.4.55–2.4.70 and standalone mod_h2 2.0.8–2.0.42 are affected. The release fixes two other flaws in mod_md and mod_vhost_alias.

Disclosed: Nov 11, 2026; Public disclosure date
Severity: Sharted; 3 CVEs tracked here
Splash zone: Apache servers that accept HTTP/2 via affected mod_http2 code. The other two CVEs affect different modules.; Apache HTTP Server · HTTP/2 · RCE
In the wild: Unknown; Apache published fixes. The sources reviewed do not confirm real-world exploitation.

What happened

CVE-2026-119618 is a race in the HTTP/2 header handling code. A remote client that can reach an affected HTTP/2 listener can trigger memory corruption, with potential code execution in the server process. Apache lists httpd 2.4.55 through 2.4.70 and standalone mod_h2 2.0.8 through 2.0.42. Red Hat identifies servers with h2 or h2c enabled as exposed to this flaw. The standalone project is archived. Use the patched module shipped with Apache httpd, or a downstream build whose vendor confirms the fix.

Apache also fixed a mod_md child-process crash affecting 2.4.30 through 2.4.70 and a mod_vhost_alias one-byte stack overwrite affecting 2.4.69 and 2.4.70. These flaws depend on their respective modules. A downstream backport can retain an older-looking version number, so verify the package release against its advisory.

What’s in the bowl

CVE-2026-119618

HTTP/2 heap corruption

A race in mod_http2 assign_headers() can lead to remote code execution.

CVE-2026-106023

mod_md child-process crash

A null pointer dereference can crash a child process while handling HTTP requests.

CVE-2026-109163

mod_vhost_alias stack overwrite

The module can overwrite one byte on the stack.

Fixed versions

Product	Safe from	Note
Apache HTTP Server	`2.4.71`

Crime-scene timeline

Nov 11, 2026
Apache releases 2.4.71 and publishes three fixes
The upstream advisory identifies CVE-2026-119618 as critical. The mod_md and mod_vhost_alias fixes ship in the same release.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Apache 2.4.71 security advisoriesPrimaryLists the three CVEs, affected versions and release date.
Apache CNA recordPrimaryConfirms the race, RCE consequence and affected upstream and standalone versions.
Standalone mod_h2 maintainer repositoryPrimaryThe standalone repository is archived; the maintainer points users to Apache httpd.
Red Hat CVE-2026-119618 analysisPrimaryDescribes the reachable HTTP/2 prerequisite and the thread-safety failure.

Wipe guide

The wipe checklist

0 of 3 sheets used

Inventory the running HTTP/2 configurationUse httpd -v or apache2 -v, the package manager, and httpd -M or apache2ctl -M. Check effective Protocols settings for every virtual host and direct origin listener, including h2 over TLS and h2c. Check separately for an externally installed mod_h2.
Install the supported fix and verify the running instanceUpgrade source builds to httpd 2.4.71 or later. For distro packages, check the vendor’s advisory for the exact fixed package release. Replace an affected standalone module with a supported patched build, then run a configuration check, restart or redeploy the service, and verify the active binary and module.
Disable HTTP/2 on unpatched listenersWhere an update must wait, remove h2 and h2c from the effective Protocols settings or disable mod_http2. Check configuration and reload; verify that neither direct nor proxied requests negotiate HTTP/2 with the affected listener. Test required traffic. This reduces exposure to the HTTP/2 flaw; the other two modules still require the update if affected.