Apache has patched a critical vulnerability in its HTTP Server that could allow for unauthenticated remote code execution (RCE). The flaw was independently reported by researchers from Anthropic and Google.
- Apache corrige une faille critique permettant l’exécution de code à distance sans authentification.
- Les versions 2.4.55 à 2.4.70 sont touchées via le module mod_http2.
- Les serveurs qui n’utilisent que HTTP/1.1 ne sont pas vulnérables.
- Il faut installer la version 2.4.71, ou désactiver HTTP/2 en attendant.
A flaw in the HTTP/2 module
Listed as CVE-2026-119618, the flaw affects Apache HTTP Server versions 2.4.55 to 2.4.70. It was patched on November 11 with the release of version 2.4.71. It resides in mod_http2, the module responsible for handling HTTP/2 traffic, a communication protocol between browsers and servers.
The vulnerability is based on a race condition, a situation where multiple processes inappropriately access the same shared resource, which can corrupt the server’s memory. According to Red Hat, an attacker could remotely exploit this flaw, without authentication, to execute arbitrary commands and take control of the server process. The publisher assigned it a CVSS score of 9.8 out of 10. Red Hat notes that “only servers that have HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable.”
Independent reports and precautions
Apache credited Anthropic’s OSS scanner with reporting the flaw on October 26. Anthony Weems and Simon Scannell from Google Cloud Vulnerability Research reported the same vulnerability independently on November 3.
For its part, cloud security company Wiz indicates that 64% of the cloud environments in its data contained resources running affected versions of Apache, and that 51% had publicly exposed instances. However, Wiz cautions that these figures do not account for server configuration and therefore do not necessarily correspond to exploitable installations. According to Wiz, when its blog post was published on November 11, no exploit was available and no in-the-wild exploitation had been reported.
Red Hat states that public research has demonstrated the existence of a reliable exploit against a server with mod_http2 enabled, though its security advisory does not identify this work. A proof of concept published on GitHub reports reproducing memory corruption and Apache process crashes, but does not demonstrate remote code execution.
Apache recommends installing version 2.4.71 or the packages provided by distribution vendors. If updates cannot be deployed immediately, disabling HTTP/2 can temporarily prevent exploitation. Another warning highlights that WordPress security updates cannot fix the issue, as the flaw affects the underlying web server.
Version 2.4.71 also fixes two other vulnerabilities: CVE-2026-106023, rated as important, which can cause server process crashes, and CVE-2026-109163, of low severity, a stack buffer overflow.
