Tuskira AdvisoryNot observedLast updatedNovember 12, 2026

CVE-2026-119618

How to tell if CVE-2026-119618 (Apache httpd mod_http2) is reachable in your environment

Latest change
First published. Apache fixed it in 2.4.71 on November 11; Red Hat says a reliable exploit has been demonstrated; not on CISA KEV.

Reachable if an Apache httpd server with mod_http2 loaded and h2 or h2c in its Protocols directive runs a build without the fix (2.4.55 through 2.4.70 upstream, or an unfixed distribution package) and untrusted clients can reach it. No login is required.

Affected
Apache httpd 2.4.55 through 2.4.70 with HTTP/2 on, and standalone mod_h2 2.0.8 through 2.0.42. Distribution builds vary; check your distribution.
Exploitation
Not observed. No attacks reported, and not on CISA KEV. Red Hat says public research has demonstrated a reliable exploit; the public code crashes worker processes.
Fix
Upgrade to httpd 2.4.71, or install your distribution's fixed package. RHEL 9 and 10 are fixed in mod_http2.
Can't patch today
Apache has published no workaround. Red Hat says servers serving only HTTP/1.1 are not affected

CVE-2026-119618 is a flaw in Apache HTTP Server's HTTP/2 module, mod_http2, that Apache rates critical and says "can lead to RCE." It affects httpd 2.4.55 through 2.4.70 and the standalone mod_h2 module 2.0.8 through 2.0.42. Apache fixed it in httpd 2.4.71 on November 11, 2026. Many servers run httpd from a Linux distribution, where the version number does not tell you whether the fix is in, so check your distribution's advisory. Red Hat fixed RHEL 9 and 10 on November 11; Debian, Amazon Linux and Ubuntu had no fix listed for their stable releases as of November 12.

Apache publishes no CVSS score; Red Hat scores it 9.8, and so does Amazon Linux. Red Hat states that "public research has demonstrated a reliable exploit against a default-configured server with the mod_http2 module enabled." The public code posted November 12 corrupts memory and crashes httpd 2.4.70 worker processes; that code does not itself show code execution. No exploitation has been reported, and it is not on CISA's Known Exploited Vulnerabilities catalog as of the November 10, 2026 release.

Vendor fixResearcher advisory

Is it reachable for you?

What it is. Apache describes a concurrent execution flaw (CWE-362) in mod_http2's assign_headers() that can lead to remote code execution. Requests reach it over HTTP/2, so a server is in scope only when mod_http2 is loaded and HTTP/2 is turned on. Apache credits Anthropic's OSS Scanner and Google Cloud Vulnerability Research with finding it.

Distribution builds. Red Hat, Debian, Ubuntu, SUSE and Amazon patch their own httpd packages and keep the original version number, so a server can report 2.4.57 and be fixed, or 2.4.62 and not be. On RHEL, mod_http2 is a separate package with its own version. Check the status below, or your distribution's tracker, before you rely on the version string.

Distribution status, from each vendor's tracker as of November 12, 2026.

  • RHEL: fixed November 11 in the mod_http2 package. RHSA-2026:98978 for RHEL 10 (mod_http2-2.0.29-5.el10_3.1) and RHSA-2026:98981 for RHEL 9 (mod_http2-2.0.26-7.el9_9.1), plus extended-support fixes RHSA-2026:98953 (10.0 EUS), RHSA-2026:98979 (10.2 EUS), RHSA-2026:98954 (9.6 EUS), RHSA-2026:98982 (9.8 EUS) and RHSA-2026:98968 (9.4 Update Services for SAP Solutions). Red Hat rates the flaw Important on RHEL 9 and 10, where its mod_http2 build gives each HTTP/2 stream a separate allocator, which Red Hat says "substantially increases the complexity of exploiting the flaw." Red Hat lists RHEL 6, 7 and 8 as not affected, and JBoss Core Services httpd and Red Hat Hardened Images as affected.
  • Debian: fixed in unstable (2.4.71-1). Bookworm, trixie and forky are still listed as vulnerable.
  • Amazon Linux: Amazon Linux 2, AL2023 and the AL2027 preview are listed as pending fix.
  • Ubuntu: no entry in Ubuntu's CVE tracker yet.

Checks, in three tiers. The first two decide exposure. The third decides priority. Run these only on servers your organization owns.

  1. Is mod_http2 loaded and HTTP/2 turned on? Run apachectl -M | grep http2 (or httpd -M) to see whether the module is loaded, then search the configuration for a Protocols directive that lists h2 or h2c. Without both, the server is out of scope.
  2. Is the build unfixed? On upstream builds, httpd -v showing 2.4.55 through 2.4.70 is affected. On distribution builds, compare the installed package against your distribution's fixed package; on RHEL that is rpm -q mod_http2. If you build the standalone mod_h2 module, 2.0.8 through 2.0.42 is affected. Check container images too, and restart httpd after updating.
  3. Can untrusted networks reach it? No login is required. An internet-facing server with HTTP/2 on goes first, followed by reverse proxies and load balancers that speak HTTP/2 to the httpd server behind them.

Identities involved. Code execution, if achieved, would run as the httpd worker's service account. Check what that account can read, including TLS private keys, application credentials and anything behind the server.

What Tuskira checks for this flaw in your environment
Apache httpd servers with mod_http2 loaded and h2 or h2c enabled, on a build without the fix
Which of those servers untrusted networks can reach
Across every system you run.
See how Tuskira finds exposed systems

Compensating controls (test them, don't assume them)

Apache has published no workaround for CVE-2026-119618. Upgrading to 2.4.71, or installing your distribution's fixed package, is the fix.

Red Hat states that "servers serving only HTTP/1.1 are not affected," because the flaw is reached only when HTTP/2 (h2 or h2c) is enabled in the Protocols directive. The first check in the reachability section shows which servers have HTTP/2 on.

What to look for in logs

Apache has published no indicators of compromise. General signals to review on servers with HTTP/2 enabled are below.

  • httpd error log entries showing child processes exiting on a segmentation fault, especially in bursts.
  • HTTP/2 traffic from sources that don't normally connect, particularly cleartext h2c on internal servers.
  • Processes started by the httpd service account that your applications don't explain.

FAQ

Am I exposed to CVE-2026-119618?

You may be if an Apache httpd server has mod_http2 loaded, h2 or h2c in its Protocols directive, a build without the fix (2.4.55 through 2.4.70 upstream, or your distribution's unfixed package), and untrusted clients can reach it. No login is needed.

Is CVE-2026-119618 being exploited?

No exploitation has been reported, and it is not on CISA KEV as of the November 10, 2026 catalog. Red Hat states that "public research has demonstrated a reliable exploit against a default-configured server with the mod_http2 module enabled." The public code posted November 12 crashes httpd 2.4.70 worker processes and does not itself show code execution.

Is there a patch?

Yes. Apache released httpd 2.4.71 on November 11, 2026. Red Hat fixed RHEL 9 and 10 the same day; other distributions are listed above.

My server says 2.4.57. Am I affected?

It depends on where the build came from. Distributions backport fixes without changing the version number, so check your distribution's advisory. On RHEL, check the mod_http2 package.

Is there a workaround?

Apache has published none. Upgrading is the fix. Red Hat states that servers serving only HTTP/1.1 are not affected.

What CVSS score does it have?

Red Hat scores it 9.8 under CVSS 3.1, and Amazon Linux gives the same score. Apache rates it critical and publishes no CVSS score. Red Hat rates it Important on RHEL 9 and 10 because of how its build allocates memory. NVD has not added its own score.

Vendor
Apache Software Foundation
Product
Apache HTTP Server (httpd) mod_http2, and the standalone mod_h2 module
Affected versions
Apache HTTP Server 2.4.55 through 2.4.70 (fixed in 2.4.71). Standalone mod_h2 2.0.8 through 2.0.42; Apache names no fixed mod_h2 release. Distribution builds keep their own version numbers, so check your distribution's advisory
Vulnerable component
mod_http2, assign_headers()
CVSS
9.8 Critical (Red Hat, CVSS 3.1; Amazon Linux gives the same score). Apache rates it critical and publishes no CVSS score. NVD has not added its own score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Red Hat and Amazon Linux)
CWE
CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization (Apache)
Exploitation
Not observed
CISA KEV added
Patch
Apache HTTP Server 2.4.71 (November 11, 2026). On distribution builds, install your distribution's fixed package; Red Hat fixed RHEL 9 and 10 on November 11 in its mod_http2 package

Updates

Nov 12, 2026. First published. Apache fixed the flaw in httpd 2.4.71 on November 11; Red Hat fixed RHEL 9 and 10 the same day; Red Hat scores it 9.8 and says public research has demonstrated a reliable exploit; public code posted November 12 crashes worker processes; no exploitation reported; not on CISA KEV.

Sources

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

We publish an advisory when a vulnerability is Critical or on CISA KEV, has one identifiable component to check, and has a public proof of concept or reported exploitation. Advisories are updated as exploitation status changes.