# SZB-33a311bb79: Apache patches critical HTTP Server RCE flaw CVE-2026-119618

Apache fixed a race condition in mod_http2 that could allow unauthenticated remote code execution on servers with HTTP/2 enabled, affecting versions 2.4.55 through 2.4.70.

- Type: Early warning
- Kind: Pending CVE
- Vendor: Apache
- Product: HTTP Server (mod\_http2)
- Attacker tool: Anthropic OSS Scanner, Google Cloud Vulnerability Research, literature.cafe
- Status: Confirmed
- Sources: 13 distinct
- First seen: 2026-11-11 13:24 UTC
- Confirmed: 2026-11-12 15:42 UTC

Written by a model from the sources below. Verify against them.

## Summary

Apache fixed a race condition in mod_http2 that could allow unauthenticated remote code execution on servers with HTTP/2 enabled, affecting versions 2.4.55 through 2.4.70. Red Hat assigned it a CVSS score of 9.8, and Wiz reported that no exploit or exploitation in the wild was known when its blog was published on November 11.

## What to do

- Upgrade Apache HTTP Server to version 2.4.71 or install the vendor-supplied packages.
- If updates cannot be deployed immediately, disable HTTP/2 to temporarily prevent exploitation.
- Identify servers running affected versions with HTTP/2 enabled and prioritize them for patching.
- Upgrade Apache HTTP Server to the fixed release.
- If you cannot patch immediately, disable HTTP/2 (h2) in the server configuration.
- Review exposed servers that have HTTP/2 enabled and prioritize them for patching.

## Timeline

- 2026-11-11 13:07 UTC: Made public by r/sysadmin
- 2026-11-11 13:24 UTC: First seen by cve.now
- 2026-11-12 15:42 UTC: Confirmed as CVE-2026-119618
- 2026-11-13 10:04 UTC: Record last updated

## Evidence (13 sources)

- 2026-11-11 · Social · [r/sysadmin](https://www.reddit.com/r/sysadmin/comments/1xthag8/cve2026119618_apache_http_server_mod_http2_heap/): “Critical RCE reported in Apache HTTP Server when using mod\_http2.”
- 2026-11-11 · Social · [Mastodon](https://infosec.exchange/@DailyCyberSecurity/117598297695126135): “Update Apache HTTP Server to 2.4.71 now to fix CVE-2026-119618, a critical mod\_http2 remote code execution flaw, alongside CVE-2026-106023.” (+5 more: [Mastodon](https://infosec.exchange/@thecybersecguru/117602117201967063), [Mastodon](https://social.circl.lu/@circl/117603590053630597), [Mastodon](https://infosec.exchange/@praetorian_security/117604149416874214), [Mastodon](https://infosec.exchange/@censys/117604777899161908), [Mastodon](https://infosec.exchange/@beyondmachines1/117608551905672442))
- 2026-11-11 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117598649598098071): “Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod\_http2 in assign\_headers() can lead to RCE.” (+2 more: [Mastodon](https://mastodon.social/@EUVD_Bot/117598649716200015), [Mastodon](https://mastodon.social/@EUVD_Bot/117598653468201004))
- 2026-11-11 · Social · [oss-security](https://seclists.org/oss-sec/2026/q4/660): “CVE-2026-106023: Apache HTTP Server: mod\_md NULL pointer dereference leads to child process crash”
- 2026-11-11 · Social · [oss-security](https://seclists.org/oss-sec/2026/q4/661): “CVE-2026-109163: Apache HTTP Server: mod\_vhost\_alias 1 byte stack buffer overwrite (after CVE-2026-63292)”
- 2026-11-11 · Social · [oss-security](https://seclists.org/oss-sec/2026/q4/662): “CVE-2026-119618: Apache HTTP Server: mod\_http2: heap corruption and RCE in assign\_headers”
- 2026-11-12 · Social · [Mastodon](https://infosec.exchange/@suriq/117601804310551633): “⚠️ PATCH NOW Apache HTTP Server 2.4.55 to 2.4.70 has a critical race in its HTTP/2 module (CVE-2026-119618) that Apache says can lead to code execution.”
- 2026-11-12 · Social · [Mastodon](https://infosec.exchange/@harrysintonen/117603196484937951): “Debian has released a fix to Apache2 mod\_http2 # CVE\_2026\_119618 vulnerability.”
- 2026-11-12 · Social · [Mastodon](https://infosec.exchange/@security_crawler_carl/117603810032720880): “thehackernews.com/2026/11/crit ical-apache-http2-flaw-could-let.html”
- 2026-11-12 · Press · [SecurityWeek](https://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google/): “Apache has patched a critical HTTP Server vulnerability that could allow unauthenticated remote code execution (RCE), following independent discoveries by Anthropic and Google researchers.”
- 2026-11-12 · Social · [Mastodon](https://literature.cafe/post/37209808): “Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know”
- 2026-11-12 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/apache-http-server-patches-critical-http-2-remote-code-execution-flaw/): “A critical vulnerability in the HTTP/2 module of Apache HTTP Server could be exploited by an unauthenticated attacker to obtain remote code execution (RCE).” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3n256hbzevp2o))
- 2026-11-12 · Social · [Mastodon](https://infosec.exchange/@karenit/117605076124494610): “A # critical race-condition # vulnerability has been identified in the # mod\_http2 module of the # Apache HTTP Server.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-33a311bb79&body=https%3A%2F%2Fcve.now%2FSZB-33a311bb79%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-33a311bb79

### Has Apache confirmed it?

Yes. Confirmed as CVE-2026-119618.

Source: https://www.reddit.com/r/sysadmin/comments/1xthag8/cve2026119618_apache_http_server_mod_http2_heap/, https://infosec.exchange/@DailyCyberSecurity/117598297695126135, https://mastodon.social/@EUVD_Bot/117598649598098071, https://seclists.org/oss-sec/2026/q4/660, https://seclists.org/oss-sec/2026/q4/661, https://seclists.org/oss-sec/2026/q4/662, https://infosec.exchange/@suriq/117601804310551633, https://infosec.exchange/@harrysintonen/117603196484937951, https://infosec.exchange/@security_crawler_carl/117603810032720880, https://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google/, https://literature.cafe/post/37209808, https://www.bleepingcomputer.com/news/security/apache-http-server-patches-critical-http-2-remote-code-execution-flaw/, https://infosec.exchange/@karenit/117605076124494610

### What should Apache and Apache HTTP Server users do?

Upgrade Apache HTTP Server to version 2.4.71 or install the vendor-supplied packages. If updates cannot be deployed immediately, disable HTTP/2 to temporarily prevent exploitation. Identify servers running affected versions with HTTP/2 enabled and prioritize them for patching. Upgrade Apache HTTP Server to the fixed release. If you cannot patch immediately, disable HTTP/2 (h2) in the server configuration. Review exposed servers that have HTTP/2 enabled and prioritize them for patching.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-119618, CVE-2026-106023 and CVE-2026-109163.

Source: https://cve.now/CVE-2026-119618, https://cve.now/CVE-2026-106023, https://cve.now/CVE-2026-109163

## Tracked as

- [CVE-2026-119618](https://cve.now/CVE-2026-119618.md)
- [CVE-2026-106023](https://cve.now/CVE-2026-106023.md)
- [CVE-2026-109163](https://cve.now/CVE-2026-109163.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-33a311bb79
Site guide for agents: https://cve.now/llms.txt