---
title: Apache httpd 2.4.71 fixes a critical mod_http2 race condition that can lead to unauthenticated RCE; only HTTP/2-enabled servers are exposed | ctxsec
url: https://ctxsec.com/items/apache-httpd-2-4-71-cve-2026-119618-mod-http2-race-rce-critical
description: "Apache released HTTP Server 2.4.71 with three fixes. CVE-2026-119618 (critical) is a race condition in mod_http2's assign_headers() that can corrupt heap memory and lead to remote code execution; it affects httpd 2.4.55 through 2.4.70 and standalone mod_h2 2.0.8 through 2.0.42. Red Hat rates it Critical, says it needs no authentication, and says public research has shown a reliable exploit against a default-configured server with mod_http2 enabled. Servers that only speak HTTP/1.1 are not affected."
status: "official (Apache HTTP Server security page and Red Hat CVE page, Nov 11, 2026); not in CISA KEV and no exploitation reported"
published: 2026-11-11
---

> Apache released HTTP Server 2.4.71 with three fixes. CVE-2026-119618 (critical) is a race condition in mod_http2's assign_headers() that can corrupt heap memory and lead to remote code execution; it affects httpd 2.4.55 through 2.4.70 and standalone mod_h2 2.0.8 through 2.0.42. Red Hat rates it Critical, says it needs no authentication, and says public research has shown a reliable exploit against a default-configured server with mod_http2 enabled. Servers that only speak HTTP/1.1 are not affected.

[← Cybersecurity News](/news) · [markdown](/items/apache-httpd-2-4-71-cve-2026-119618-mod-http2-race-rce-critical.md)

official (Apache HTTP Server security page and Red Hat CVE page, Nov 11, 2026); not in CISA KEV and no exploitation reported

2026-11-11 3:36 PM ET

### Apache httpd 2.4.71 fixes a critical mod_http2 race condition that can lead to unauthenticated RCE; only HTTP/2-enabled servers are exposed

- **Do now:** upgrade to 2.4.71 (or your distro's patched package). If you can't yet, remove `h2` and `h2c` from the `Protocols` directive so the server falls back to HTTP/1.1.
- **Distro notes (Red Hat):** RHEL 9 and 10 ship mod_http2 with a separate allocator per stream, which makes exploitation much harder, so Red Hat rates them Important; RHEL 8 and earlier are not affected.
- **Also fixed:** CVE-2026-106023 (important), a mod_md NULL pointer dereference that crashes child processes (2.4.30 to 2.4.70), and CVE-2026-109163 (low), a 1-byte stack overwrite in mod_vhost_alias (2.4.69 and 2.4.70).
- **Credit:** Apache credits Anthropic's OSS Scanner and Google Cloud Vulnerability Research. watchTowr says it is investigating and calls the issue configuration-specific.

Sources: [Apache HTTP Server 2.4 vulnerabilities: fixed in 2.4.71 (Nov 11, 2026)](https://httpd.apache.org/security/vulnerabilities_24.html) · [Red Hat: CVE-2026-119618](https://access.redhat.com/security/cve/cve-2026-119618) · [watchTowr on X (Nov 11, 2026)](https://x.com/watchtowrcyber/status/2120589618131124245)