Critical Apache HTTP/2 Bug: Update to 2.4.71 Now

If you run a website on Apache, this is one to patch today. The Apache Software Foundation shipped Apache HTTP Server 2.4.71 on November 11, 2026, and it fixes a critical bug in the HTTP/2 module that could let someone on the internet run code on your server without logging in. It's tracked as CVE-2026-119618.

What happened

According to the official Apache httpd security page, the flaw sits in a function called assign_headers() inside mod_http2. It's a race condition: two threads touch the same piece of memory without proper locking, and that can corrupt the heap. Apache rates it critical and says it can lead to remote code execution. Amazon's Linux security center lists a CVSS score of 9.8 out of 10.

Affected versions are Apache HTTP Server 2.4.55 through 2.4.70. If you build the standalone mod_h2 module from GitHub instead, versions 2.0.8 through 2.0.42 are affected.

Two separate teams found it. Anthropic's open-source scanner reported it on October 26, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported it on November 3. The fix landed and 2.4.71 went out on November 11.

The same release fixes two smaller bugs. One, rated important, is a NULL pointer crash in mod_md (the module that handles automatic Let's Encrypt certificates) affecting 2.4.30 through 2.4.70. The other, rated low, is a one-byte stack overwrite in mod_vhost_alias on 2.4.69 and 2.4.70.

Why it matters

Apache is still one of the most common web servers out there, and HTTP/2 is switched on in a lot of setups because it makes sites load faster. The cloud security company Wiz says 64% of the cloud environments it can see have resources running a vulnerable version, and 51% have instances exposed to the internet. Wiz points out that this count ignores configuration, so not every one of those servers has HTTP/2 turned on.

The good news, for now: Wiz says no public exploit exists and nobody has reported attacks in the wild. That window doesn't usually stay open for long once a patch is public, since attackers can compare the old and new code to see exactly what changed.

Distro packages are lagging. When I checked the Debian security tracker, only Debian unstable had the fixed 2.4.71 build, while Bookworm and Trixie were still marked vulnerable. Amazon Linux 2 and 2023 showed "Pending Fix". So running apt upgrade may not save you yet.

What to do now

1. Check your version. On the server, run apachectl -v (or httpd -v on Red Hat-style systems). Anything from 2.4.55 to 2.4.70 is in range.

2. Check if HTTP/2 is loaded. Run apachectl -M | grep http2. If you see http2_module, and your config has h2 or h2c in a Protocols line, you're exposed. No output means the vulnerable module isn't loaded.

3. Update. Install 2.4.71 or your distro's patched package as soon as it appears. Debian, Red Hat and Amazon each have a CVE page that will show when a fixed package lands, so keep an eye on the one for your system.

4. If you can't update yet, turn HTTP/2 off. Wiz recommends this stopgap: set Protocols http/1.1 (the directive is explained in the mod_http2 docs) in your main config or virtual hosts, remove any h2 and h2c entries, then run apachectl configtest and reload Apache. Your site will be a bit slower on some connections, but it closes this hole.

5. On shared hosting, you can't patch Apache yourself. Open a support ticket and ask your host whether they've applied the fix for CVE-2026-119618 or disabled HTTP/2.

My take

I'd treat this as an "update tonight" bug rather than a "this weekend" one. A 9.8 score, no login needed, and a race condition two different teams found within a week of each other: that's the kind of bug that gets weaponized fast once a patch tells everyone where to look.

Who should actually worry? Anyone with a VPS or cloud server running Apache, anyone self-hosting WordPress, Nextcloud or a forum on a LAMP stack, and developers who left a test server open to the internet. If your site sits on nginx, Caddy or LiteSpeed alone, this specific bug doesn't touch you, though it's worth checking that Apache isn't quietly running behind your proxy. Plenty of small Indian businesses run their sites on budget shared hosting and never look at the server side at all. If that's you, the ticket in step 5 is the single most useful thing you can do today.

The trickiest group is people who pinned an older distro and assume security updates just flow in. They usually do, but this time the official release came out before most distro packages caught up. If your Debian or Amazon Linux box shows no update yet, the HTTP/1.1 workaround is worth the five minutes.

It's also part of a pattern I've been writing about. In the past few weeks we covered the PHP session upload flaw and the WordPress bug CISA added to its exploited list. This one was partly caught by an AI scanning tool, and with more of those tools pointed at open-source code, I expect critical web-stack bugs to keep arriving at this pace. If you run anything on a home server, the patching habits in our Pi-hole and WireGuard setup guide apply here too. And if you suspect a machine was already compromised, our malware check guide walks through what to look for.

Sources: Apache HTTP Server 2.4 vulnerabilities, Wiz, Debian security tracker, Amazon Linux Security Center, and The Hacker News, which flagged the story.