Every Apache HTTP Server release from 2.4.55, shipped in January 2023, through 2.4.70 has a race condition in its HTTP/2 code that can lead to remote code execution. The Apache Software Foundation rates it critical (CVE-2026-119618) and fixed it in 2.4.71, released on November 11, 2026. Two teams found it independently: Anthropic's open source scanner reported it on October 26, and Google Cloud's vulnerability research team got there eight days later.
What breaks in mod_http2
The bug lives in assign_headers() inside mod_http2, the module that implements HTTP/2 in httpd. Several threads touch a shared resource without proper synchronization, which corrupts the heap. According to Wiz's analysis, a remote, unauthenticated attacker can turn that corruption into code execution with the privileges of the web server process. When Wiz published its analysis there was no public exploit and no known exploitation, but if two teams found the same bug on their own within eight days, it's safer to assume others will too.
Wiz puts a number on the exposure: 64% of the cloud environments it sees run a vulnerable version, and 51% have such instances exposed to the internet. That figure looks at versions, not configuration, so treat it as a ceiling: you're only exposed if HTTP/2 is turned on.
Am I affected?
You need all three: a version between 2.4.55 and 2.4.70, mod_http2 loaded, and h2 (over TLS) or h2c (cleartext) in the Protocols directive of some server or virtual host. Protocols only allows http/1.1 by default, so HTTP/2 is something someone switched on deliberately. If you inherited your config from a template, check anyway.
apachectl -v # version
apachectl -M | grep http2 # is http2_module loaded?
grep -RniE '^\s*Protocols' /etc/httpd /etc/apache2 2>/dev/null
# From outside: does it negotiate HTTP/2? (prints "2" if so)
curl -sI --http2 https://your-domain -o /dev/null -w '%{http_version}\n'If you build mod_h2 separately from GitHub, versions 2.0.8 through 2.0.42 are affected.
Upgrading to 2.4.71
- Containers: the official image already ships
httpd:2.4.71,httpd:2.4.71-alpineandhttpd:2.4.71-trixie. Pin the versioned tag in yourDockerfileinstead ofhttpd:2.4orlatest, so the change shows up in history and doesn't depend on when the image happens to be rebuilt. - Distro packages: Linux distributions usually backport the fix onto their own version rather than moving to 2.4.71. Check your distro's security advisory for CVE-2026-119618 instead of relying on the number
apachectl -vprints. - Built from source: download 2.4.71 from the official site and verify the signature before building.
FROM httpd:2.4.71-alpineCan't upgrade today? Turn HTTP/2 off
The official mitigation is to leave Protocols http/1.1 and drop h2 and h2c. The catch is that Protocols is set per server and per virtual host: changing it in httpd.conf does nothing if a <VirtualHost> declares its own Protocols h2 http/1.1, which is the norm on multi-site setups. Go through every file the grep above finds, or simply stop loading mod_http2: the Apache docs state that an unavailable protocol listed in Protocols is just ignored.
apachectl configtest && apachectl gracefulgraceful reloads the config without dropping open connections. The price is HTTP/1.1 between clients and Apache, meaning more connections per client and a bit more latency on asset-heavy pages. If a CDN or load balancer in front speaks HTTP/2 to browsers, users will barely notice.
The other two CVEs in 2.4.71
The release also fixes CVE-2026-106023 (important), a NULL pointer dereference in mod_md that crashes the child process and goes back to 2.4.30; and CVE-2026-109163 (low), a one-byte stack overflow in mod_vhost_alias that only affects 2.4.69 and 2.4.70. Disabling HTTP/2 mitigates neither, so the mitigation is a stopgap, not a substitute for upgrading.
Before it hits production
- Check the actual version inside the container, or the package against your distro's advisory, not just the tag.
- Run
apachectl configtestagainst the production config: 2.4.71 also changesmod_remoteip: trusted proxy lists now apply per virtual host and merge with the main server's, with a log warning when both define them. - Rerun the
curl --http2check to confirm HTTP/2 still negotiates if you kept it, or that it no longer does if you applied the mitigation. - If you switched HTTP/2 off as a stopgap, put a date on turning it back on so you don't stay on HTTP/1.1 by accident.
Sources
- Apache HTTP Server 2.4 vulnerabilities, Apache Software Foundation.
- CHANGES 2.4.71, Apache Software Foundation.
- Critical RCE Vulnerability in Apache HTTP Server, Wiz, November 11, 2026.
- Protocols directive, Apache httpd documentation.
- Official httpd image, Docker Hub.