Apache has released HTTP Server 2.4.71 to address CVE-2026-119618, a critical vulnerability in its mod_http2 module that may let an unauthenticated remote attacker execute commands on an affected server. The flaw stems from a race condition that can corrupt server memory when multiple threads access shared resources improperly.
The vulnerability affects Apache HTTP Server versions 2.4.55 through 2.4.70. Apache issued the fix on November 11. According to Red Hat, only servers with HTTP/2 enabled are affected; systems configured to serve HTTP/1.1 only are not vulnerable. Red Hat assigned the issue a CVSS score of 9.8 and said successful exploitation could give an attacker control of the server process.
Independent reports led to the patch
Apache credited Anthropic’s OSS Scanner with reporting the flaw on October 26. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research independently reported the same issue on November 3. The separate findings point to a defect in the server’s HTTP/2 handling rather than an application-layer problem.
Apache’s mod_http2 module processes HTTP/2 traffic. In the reported race condition, concurrent threads can improperly interact with shared resources, potentially damaging memory used by the server. Red Hat describes the potential outcome as remote execution of arbitrary commands without authentication. The vulnerability’s severity makes prompt assessment important, but exposure depends on the server version and configuration.
Cloud exposure figures require configuration checks
Cloud security company Wiz reported that 64% of cloud environments in its data contained resources running affected Apache versions, and 51% had publicly exposed instances. Wiz cautioned that the figures do not account for server configuration. They therefore should not be interpreted as the share of environments with an exploitable installation: HTTP/2 must be enabled for this vulnerability to apply.
Evidence about exploitability also differs by report and timing. Red Hat says public research has demonstrated a reliable exploit against a server with mod_http2 enabled, without identifying that research in its advisory. Wiz said that, when its blog post was published on November 11, it knew of no available exploit and no reports of exploitation in the wild. A GitHub proof of concept reports reproducing memory corruption and Apache process crashes, but does not demonstrate remote code execution.
These distinctions matter for cloud and enterprise operators prioritizing remediation. Affected version numbers, public accessibility and HTTP/2 configuration are separate indicators: an exposed instance running an affected version is not necessarily vulnerable if HTTP/2 is disabled. Conversely, a server using an affected release with HTTP/2 enabled requires attention even if its applications have received their own security updates.
Update the server, not just the application
Organizations should upgrade to Apache HTTP Server 2.4.71 or apply packages supplied by their operating-system or software vendor. If an update cannot be deployed immediately, disabling HTTP/2 can serve as a temporary mitigation, since the flaw affects servers with that protocol enabled. Administrators should verify the actual server package and configuration rather than assume that updating an application has addressed the underlying issue.
In particular, WordPress security updates cannot fix this vulnerability because it resides in Apache’s web-server code, not WordPress. Teams should coordinate remediation at the server layer and confirm that the fixed release or vendor-provided patch is in place. Temporary protocol changes should be treated as mitigation while patching is pending, not as a substitute for installing the correction.
Version 2.4.71 also addresses two other vulnerabilities. CVE-2026-106023 is described as an important issue that can crash server processes, while CVE-2026-109163 is a low-severity stack buffer overflow. The release therefore includes fixes beyond the critical HTTP/2 issue, giving administrators an additional reason to review Apache deployments for updates.
