Apache HTTP Server · Exploitation reported

Apache Releases 2.4.71 for Critical Unauthenticated Remote Code Execution

Nov 12, 2026 · 1 min read

CVE-2026-119618 affects mod_http2 in versions 2.4.55 through 2.4.70 with HTTP/2 enabled and allows unauthenticated remote code execution. Version 2.4.71 fixes the flaw, but some platforms still await updates; Red Hat demonstrated a reliable exploit, with no in-the-wild exploitation reported. Upgrade or apply the vendor backport, or disable h2 and h2c if updating is not possible.

By HIFY Radar newsroom Updated 11/12/2026 02:33 AM Get this every day →← Back to the feed 3 sources

CriticalVulnerabilityExploitation reportedPartial fix

In 30 seconds

Observed

Apache HTTP Server 2.4.71 is reported to fix CVE-2026-119618, a critical remote-code-execution flaw in mod_http2 affecting versions 2.4.55 through 2.4.70 when HTTP/2 is enabled. The reported attack requires no authentication, so exposed servers should be updated or moved off HTTP/2 until a vendor fix is available.

What happened

Observed

The flaw was disclosed as CVE-2026-119618 and assigned a reported CVSS score of 9.8. Coverage identifies Apache's mod_http2 module as the affected component and version 2.4.71 as the upstream correction.

Why it matters

Alleged

The risk is unusually serious because a reachable attacker reportedly needs no account to attempt code execution. Red Hat was cited as saying a reliable exploit had been demonstrated against a default Apache configuration with HTTP/2 enabled and could yield control of the server process.

What to do

Observed

Prioritize internet-facing Apache servers using HTTP/2. Install 2.4.71 or the relevant vendor backport. If neither is available, the supplied guidance recommends disabling both h2 and h2c and temporarily serving traffic over HTTP/1.1.

Confirmed and still uncertain

Inferred

The affected version range, HTTP/2 requirement and fixed upstream release are consistently identified in the supplied reports. No exploitation in the wild had been reported in the cited update, but that does not establish that exploitation never occurred. The evidence also does not quantify how many reachable servers remain vulnerable.

What people are saying

Alleged

The Hacker News relayed Red Hat's assessment that the exploit was reliable on a default HTTP/2-enabled configuration. DailyDarkWeb separately urged defenders to prioritize exposed servers and verify vendor backports, while noting that HTTP/1.1-only deployments are outside this flaw's reported scope.

Evolution

Observed

The initial disclosure established the critical flaw, the affected 2.4.55-to-2.4.70 range and the 2.4.71 fix. Subsequent updates added two operational details: a reportedly reliable exploit had been demonstrated, and patch availability still differed across operating-system vendors.

Reach

Observed

3 independent groups, 4 updates, and 8 engagements.

Technical detail

Observed

The available evidence places the vulnerability in mod_http2 and describes its outcome as unauthenticated remote code execution. It does not provide the underlying programming error, exploit payload, request sequence or the operating-system privileges obtained after code execution, so those details remain unestablished here.

Sources and evidence

Observed

The evidence lot includes Apache's security-page URL, but no excerpted body from that page. Consequently, the detailed version, impact, exploit and platform-status statements in this account rely on the supplied news excerpt and social posts, with Red Hat's conclusions available only through secondary attribution.