Karen IT Security Response Center (KSRC) Advisory

Advisory ID: KSRC-2026-11121 | Publication Date: 12 November 2026

Critical Remote Code Execution in Apache HTTP Server mod_http2
CVE-2026-119618

Summary

A critical race-condition vulnerability has been identified in the mod_http2 module of the Apache HTTP Server. Tracked as CVE-2026-119618, the flaw allows an unauthenticated remote attacker to trigger heap corruption and achieve remote code execution on servers that have HTTP/2 enabled.

The vulnerability has been assigned a CVSS v3.1 score of 9.8 (Critical). Apache HTTP Server versions 2.4.55 through 2.4.70 are affected. The issue was fixed in version 2.4.71, released on 11 November 2026. Public proof-of-concept material is available.

Technical Overview

HTTP/2 permits multiple concurrent requests over a single connection. The mod_http2 module processes these requests using multiple threads. Due to insufficient synchronization in the assign_headers() function, one worker thread can write into memory belonging to another thread.

This improper concurrent access corrupts the server’s internal heap structures. An attacker who can reach a vulnerable server and negotiate HTTP/2 can reliably trigger the condition and execute arbitrary code in the context of the Apache process, without authentication.

Only configurations that enable HTTP/2 (via the Protocols directive containing h2 or h2c) are exposed. Servers restricted to HTTP/1.1 are not vulnerable. Standalone releases of mod_h2 (versions 2.0.8 through 2.0.42) are also affected.

Affected Systems

• Apache HTTP Server 2.4.55 – 2.4.70
• Standalone mod_h2 2.0.8 – 2.0.42
• Any distribution packaging the above versions with HTTP/2 enabled (including common enterprise and hosting environments)

Fixed version: Apache HTTP Server 2.4.71 (released 11 November 2026).

Major Linux distributions and hosting control panels (including cPanel-related packages) have begun releasing updated packages.

Exploitation Status

• Public disclosure and upstream patch released on 11 November 2026.
• Independently reported by Anthropic’s OSS Scanner and by researchers from Google Cloud Vulnerability Research.
• Public proof-of-concept material appeared on GitHub shortly after disclosure.
• Reliable exploitation against default configurations using the event MPM with mod_http2 enabled has been demonstrated in public analysis.
• Not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of this advisory’s publication.

Recommendations

1. Immediate Action: Upgrade Apache HTTP Server to version 2.4.71 or later, or apply the security update provided by your operating system or hosting provider.
2. After upgrading, restart the Apache service (or reload if the package documentation confirms a graceful reload is sufficient) so the patched module is loaded.
3. If an immediate upgrade is not possible, disable HTTP/2 by ensuring the Protocols directive contains only http/1.1 (remove h2 and h2c). Verify the change with a client that requests HTTP/2, then reload Apache.
4. Confirm whether HTTP/2 is enabled on each virtual host; a global HTTP/1.1 setting does not override a virtual-host configuration that enables h2.
5. Review access logs and system logs for unusual concurrent request patterns or unexpected process behavior around and after 11 November 2026.
6. For managed hosting or cPanel environments, confirm with the provider that the urgent Apache packages containing the fix have been applied.
7. If compromise is suspected, treat the system as compromised: isolate it, preserve forensic evidence, rotate credentials, and perform a full integrity review.

Because Apache HTTP Server is widely deployed across public-facing websites, reverse proxies, and application front-ends, organizations should treat this as a high-priority emergency patch.

Karen IT
We make the Internet harder to abuse.