Apache HTTP Server’s HTTP/2 module, mod_http2, has a critical race-condition flaw tracked as CVE-2026-119618, rated 9.8 out of 10 on the CVSS scale, that could let a remote, unauthenticated attacker corrupt memory and potentially execute code with the server process’s privileges.

The bug occurs in the assign_headers() function when concurrent threads access shared resources, and was independently discovered by Anthropic and Google Cloud’s Vulnerability Research Team.

The vulnerability affects Apache HTTP Server versions 2.4.55 through 2.4.70 when HTTP/2 is enabled; the Apache project released version 2.4.71 on November 11, 2026, to fix it.

Standalone GitHub mod_h2 builds from versions 2.0.8 through 2.0.42 are also affected, though the article gives conflicting information about the patched version: it lists both 2.0.24 and 2.0.42.

Anthropic’s OSS Scanner reported the flaw on October 26, 2026, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research also reported it; earlier Apache HTTP/2 updates through version 2.4.70 did not fix this newly disclosed issue.

Red Hat said public research had demonstrated a reliable exploit against a default server configuration with mod_http2 enabled, while Wiz reported that no exploit was available and there had been no in-the-wild exploitation.

Wiz data cited in the article indicates that 64% of cloud environments contain vulnerable resources and 51% have publicly exposed instances, though the figures do not account for configuration.

A compromised cloud-hosted Apache server could provide a foothold for lateral movement to nearby microservices or cloud metadata endpoints.

Administrators should check the Protocols directive for the whole server and every virtual host, since HTTP/2 can be enabled as h2 over TLS or h2c over plain TCP; if an update is not yet possible, Wiz recommends removing both protocols and leaving http/1.1, although Apache’s advisory lists no workaround.

The main recommendation is to upgrade Apache HTTP Server to 2.4.71 or later and use a patched standalone mod_h2 build, or temporarily disable HTTP/2 by removing h2 and h2c from the active protocol configuration.

Debian unstable (sid) has a fix in apache2 2.4.71-1, while Debian bookworm, trixie and forky were listed as vulnerable; Amazon Linux fixes were pending, and the article found no Ubuntu status page for the vulnerability.

Red Hat shipped fixes for Enterprise Linux 9 and 10, while Enterprise Linux 8 and earlier are not affected; Red Hat rates the issue Important for affected releases because per-stream memory allocation makes exploitation harder.