On November 11, the Apache Software Foundation released Apache HTTP Server 2.4.71, which fixes three vulnerabilities; the most severe is CVE-2026-119618, rated as critical by Apache: a race condition in the function assign_headers() of the module mod_http2 (CWE-362) that corrupts the heap and allows unauthenticated remote code execution according to the Apache advisory. It affects versions 2.4.55 through 2.4.70 inclusive and the standalone module mod_h2 2.0.8–2.0.42, whose repository has been archived since June 2026 and will not receive an official patch confirmed by Rescana.
The race condition in assign_headers allows unauthenticated RCE
The flaw occurs when concurrent HTTP/2 requests access shared resources without proper synchronization. Only servers with HTTP/2 enabled —the Protocols h2 or h2cdirective— reach the vulnerable code; HTTP/1.1-only configurations are not exposed as clarified by SOCPrime. The report came through two independent channels: Anthropic’s OSS scanner (October 26, identifier ANT-2026-MAPKT6MZ) and Anthony Weems with Simon Scannell of Google Cloud Vulnerability Research (November 3). Apache landed the fix in commit 824beab9b9424d6cfb29595248fdbf6c3dddeab1 and released 2.4.71 eleven days later. The same release also addresses CVE-2026-106023 (null dereference in mod_md, severity important) and CVE-2026-109163 (stack overwrite in mod_vhost_alias, severity low).
Standalone mod_h2 left without official patch, forcing migration
The module mod_h2 maintained on GitHub (used in custom builds and containers) has no fixed version published. The only supported path is to migrate to the mod_http2 integrated in httpd 2.4.71 or manually apply the backported patch in your fork. If you maintain base images or containers that embed mod_h2, audit them now: there will be no official backported patch.
Distros and vendors move at different paces
Debian unstable (sid) already includes apache2 2.4.71-1; bookworm, trixie, forky and Ubuntu still had no package as of November 11. Red Hat released updates for RHEL 9 (mod_http2-2.0.26-7.el9_9.1) and RHEL 10 (2.0.29-5.el10_3.1), but rates the severity as Important arguing that its per-stream allocator raises exploitation complexity; RHEL 8 and earlier do not contain the vulnerable code Rescana details. Verify your provider’s schedule before assuming coverage.
What to do today: update, disable HTTP/2, or mitigate while the package arrives
The priority is to update to 2.4.71 or your OS security package as soon as it’s available, starting with internet‑facing front‑ends that have HTTP/2 enabled. Validate third‑party module compatibility and configuration in a test environment before promoting to production. If you can’t update right away, disable HTTP/2 by removing h2 and h2c from the Protocols (global and in all VirtualHosts) and force Protocols http/1.1; it’s a defensive hardening, not a fix, and you lose multiplexing and push recommends SOCPrime. Take inventory with httpd -M | grep http2 and review Protocols in httpd.conf and all includes. Monitor logs after patching: worker crashes with SIGSEGV in assign_headers or unexpected restarts may indicate failed exploitation attempts notes Apache. Finally, ask your SaaS, PaaS, or CDN providers that use Apache as a front‑end whether they have already applied 2.4.71 or an equivalent backported patch.
Structured reference for readers and AI agents
{
"format": "rafael-fuentes-article/1.0",
"language": "en",
"title": "Apache HTTP Server 2.4.71 Fixes Critical RCE in mod_http2 (CVE-2026-119618)",
"summary": "Apache releases version 2.4.71 fixing a race condition in mod_http2 that allows unauthenticated remote code execution on servers with HTTP/2 enabled.",
"author": "Rafael Fuentes",
"publicationDate": "2026-11-12T20:01:16.040+01:00",
"eventDate": "2026-11-11",
"url": "https://falifuentes.com/rafael-fuentes-2026-11-12-pm-en/",
"translation": {
"language": "es",
"url": "https://falifuentes.com/rafael-fuentes-2026-11-12-pm-es/"
},
"topics": [
"Cybersecurity",
"Cybersecurity News",
"English"
],
"sources": [
"https://www.rescana.com/post/apache-httpd-mod-http2-cve-2026-119618-patch-now",
"https://socprime.com/blog/cve-2026-119618-critical-apache-http-2-flaw-enables-remote-code-execution"
]
}