> ## Content Index > Fetch the complete content index at: https://blog.harshkohli.com/llms.txt > Use this file to discover other available public pages before exploring further. # Critical Apache HTTP/2 Bug: Update to 2.4.71 Now - URL: https://blog.harshkohli.com/apache-http2-cve-2026-119618-update-2-4-71/ - Published: 2026-11-12T07:35:43.000Z - Updated: 2026-11-12T07:35:43.000Z - Description: CVE-2026-119618 in Apache's mod_http2 allows unauthenticated remote code execution on 2.4.55 to 2.4.70. How to check, patch or disable HTTP/2. - Author: Harsh Kohli - Tags: Tech News, Software If you run a website on Apache, this is one to patch today. The Apache Software Foundation shipped Apache HTTP Server 2.4.71 on November 11, 2026, and it fixes a critical bug in the HTTP/2 module that could let someone on the internet run code on your server without logging in. It's tracked as CVE-2026-119618. ## What happened According to the [official Apache httpd security page](https://httpd.apache.org/security/vulnerabilities%5F24.html?ref=blog.harshkohli.com#CVE-2026-119618), the flaw sits in a function called `assign_headers()` inside `mod_http2`. It's a race condition: two threads touch the same piece of memory without proper locking, and that can corrupt the heap. Apache rates it critical and says it can lead to remote code execution. Amazon's [Linux security center](https://explore.alas.aws.amazon.com/CVE-2026-119618.html?ref=blog.harshkohli.com) lists a CVSS score of 9.8 out of 10. Affected versions are Apache HTTP Server 2.4.55 through 2.4.70\. If you build the standalone `mod_h2` module from GitHub instead, versions 2.0.8 through 2.0.42 are affected. Two separate teams found it. Anthropic's open-source scanner reported it on October 26, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported it on November 3\. The fix landed and 2.4.71 went out on November 11. The same release fixes two smaller bugs. One, rated important, is a NULL pointer crash in `mod_md` (the module that handles automatic Let's Encrypt certificates) affecting 2.4.30 through 2.4.70\. The other, rated low, is a one-byte stack overwrite in `mod_vhost_alias` on 2.4.69 and 2.4.70. ## Why it matters Apache is still one of the most common web servers out there, and HTTP/2 is switched on in a lot of setups because it makes sites load faster. The cloud security company [Wiz says](https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability?ref=blog.harshkohli.com) 64% of the cloud environments it can see have resources running a vulnerable version, and 51% have instances exposed to the internet. Wiz points out that this count ignores configuration, so not every one of those servers has HTTP/2 turned on. The good news, for now: Wiz says no public exploit exists and nobody has reported attacks in the wild. That window doesn't usually stay open for long once a patch is public, since attackers can compare the old and new code to see exactly what changed. Distro packages are lagging. When I checked the [Debian security tracker](https://security-tracker.debian.org/tracker/CVE-2026-119618?ref=blog.harshkohli.com), only Debian unstable had the fixed 2.4.71 build, while Bookworm and Trixie were still marked vulnerable. Amazon Linux 2 and 2023 showed "Pending Fix". So running `apt upgrade` may not save you yet. ## What to do now **1\. Check your version.** On the server, run `apachectl -v` (or `httpd -v` on Red Hat-style systems). Anything from 2.4.55 to 2.4.70 is in range. **2\. Check if HTTP/2 is loaded.** Run `apachectl -M | grep http2`. If you see `http2_module`, and your config has `h2` or `h2c` in a `Protocols` line, you're exposed. No output means the vulnerable module isn't loaded. **3\. Update.** Install 2.4.71 or your distro's patched package as soon as it appears. Debian, [Red Hat](https://access.redhat.com/security/cve/cve-2026-119618?ref=blog.harshkohli.com) and Amazon each have a CVE page that will show when a fixed package lands, so keep an eye on the one for your system. **4\. If you can't update yet, turn HTTP/2 off.** Wiz recommends this stopgap: set `Protocols http/1.1` (the directive is explained in the [mod\_http2 docs](https://httpd.apache.org/docs/2.4/mod/mod%5Fhttp2.html?ref=blog.harshkohli.com)) in your main config or virtual hosts, remove any `h2` and `h2c` entries, then run `apachectl configtest` and reload Apache. Your site will be a bit slower on some connections, but it closes this hole. **5\. On shared hosting,** you can't patch Apache yourself. Open a support ticket and ask your host whether they've applied the fix for CVE-2026-119618 or disabled HTTP/2. ## My take I'd treat this as an "update tonight" bug rather than a "this weekend" one. A 9.8 score, no login needed, and a race condition two different teams found within a week of each other: that's the kind of bug that gets weaponized fast once a patch tells everyone where to look. Who should actually worry? Anyone with a VPS or cloud server running Apache, anyone self-hosting WordPress, Nextcloud or a forum on a LAMP stack, and developers who left a test server open to the internet. If your site sits on nginx, Caddy or LiteSpeed alone, this specific bug doesn't touch you, though it's worth checking that Apache isn't quietly running behind your proxy. Plenty of small Indian businesses run their sites on budget shared hosting and never look at the server side at all. If that's you, the ticket in step 5 is the single most useful thing you can do today. The trickiest group is people who pinned an older distro and assume security updates just flow in. They usually do, but this time the official release came out before most distro packages caught up. If your Debian or Amazon Linux box shows no update yet, the HTTP/1.1 workaround is worth the five minutes. It's also part of a pattern I've been writing about. In the past few weeks we covered the [PHP session upload flaw](https://blog.harshkohli.com/php-cve-2026-115560-session-upload-progress/) and the [WordPress bug CISA added to its exploited list](https://blog.harshkohli.com/wordpress-cve-2026-119977-cisa-kev/). This one was partly caught by an AI scanning tool, and with more of those tools pointed at open-source code, I expect critical web-stack bugs to keep arriving at this pace. If you run anything on a home server, the patching habits in our [Pi-hole and WireGuard setup guide](https://blog.harshkohli.com/raspberry-pi-pihole-wireguard-vpn-setup/) apply here too. And if you suspect a machine was already compromised, our [malware check guide](https://blog.harshkohli.com/nikke-pc-launcher-malware-check-clean/) walks through what to look for. Sources: [Apache HTTP Server 2.4 vulnerabilities](https://httpd.apache.org/security/vulnerabilities%5F24.html?ref=blog.harshkohli.com), [Wiz](https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability?ref=blog.harshkohli.com), [Debian security tracker](https://security-tracker.debian.org/tracker/CVE-2026-119618?ref=blog.harshkohli.com), [Amazon Linux Security Center](https://explore.alas.aws.amazon.com/CVE-2026-119618.html?ref=blog.harshkohli.com), and [The Hacker News](https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html?ref=blog.harshkohli.com), which flagged the story.