The Apache Software Foundation released HTTP Server 2.4.71 on November 11 to fix CVE-2026-119618, a critical race condition in mod_http2 that can let an unauthenticated remote attacker run code. Red Hat rates the flaw CVSS 9.8.
How CVE-2026-119618 Corrupts Heap Memory
The flaw is an improper synchronization error in the assign_headers() function of mod_http2. The race corrupts heap memory, and that corruption can give an unauthenticated attacker code execution on the server.
Apache 2.4.55-2.4.70 and mod_h2 Versions Affected
The vulnerability affects Apache HTTP Server 2.4.55 through 2.4.70 and the standalone mod_h2 module in versions 2.0.8 through 2.0.42. Only servers that enable HTTP/2 are exposed. That means the Protocols directive must enable h2 or h2c, either server-wide or in a per-virtual-host setting.
Securityonline notes that Apache serves roughly 20 percent of active websites and that HTTP/2 is commonly enabled, which widens the potential exposure.
Anthropic OSS Scanner and Google Cloud Researchers Found It
Anthropic’s OSS Scanner discovered the flaw under the identifier ANT-2026-MAPKT6MZ. Google Cloud analysts Anthony Weems and Simon Scannell also reported it.
Red Hat and Wiz Disagree on Exploit Availability
The two vendors gave conflicting accounts of exploit availability. Red Hat said public research demonstrated a reliable exploit against a default configuration. Wiz said later the same day that no exploit was available and that no in-the-wild exploitation had been reported. The conflict was unresolved as of November 12.
Other Fixes in the Same Release
Apache 2.4.71 also fixes two lower-severity issues. CVE-2026-106023 is a NULL pointer crash in mod_md that Apache rated important. CVE-2026-109163 is a one-byte stack overwrite in mod_vhost_alias that Apache rated low.
Distribution Patches From Red Hat
Red Hat released fixes for RHEL 9 and RHEL 10. One example build is mod_http2-2.0.26-7.el9_9.1. Administrators running distribution packages receive the fix through those builds rather than through the upstream 2.4.71 release.
Scope of Exposure Depends on the Protocols Directive
Because the vulnerable code runs only when HTTP/2 is enabled, the practical exposure depends on each server’s Protocols settings. A server that does not list h2 or h2c is not affected, even on a vulnerable version. Per-virtual-host settings mean a single server can have some sites exposed and others not.
The Hacker News and Securityonline both reported the release, and both advise upgrading to 2.4.71 or to a distribution-patched build and checking Protocols directives across all virtual hosts. No attacks have been reported, and the conflicting exploit claims leave open whether a working public exploit exists.
The disclosure adds a further data point to the growing role of automated scanning tools in finding memory-safety and concurrency flaws in mature infrastructure software. Anthropic’s scanner, together with Google Cloud analysts, found the same bug independently, and a race condition of this type is difficult to find through conventional review. The result is a CVSS 9.8 rating on a component that sits in front of a large share of web traffic.
Reporting Sources and Open Questions Around the Apache Release
The Hacker News and Securityonline reported the Apache release, and Red Hat published its own advisories on the same day. The reports agree on the affected versions, the CVSS 9.8 rating from Red Hat and the November 11 release date of version 2.4.71.
Two questions remain unanswered in the coverage. The first is whether a reliable public exploit exists, since Red Hat and Wiz gave opposite accounts on November 11. The second is how many internet-facing servers have HTTP/2 enabled through the Protocols directive, a figure the reports do not provide.
The release also carries a broader maintenance load than the headline flaw suggests. Version 2.4.71 bundles fixes for a mod_md crash and a mod_vhost_alias stack overwrite, so organizations that move to the new release pick up all three corrections together, while those on distribution builds receive them through their vendor’s own packaging, such as the Red Hat builds for RHEL 9 and 10.
