Apache 2.4.71 Fixes Critical mod_http2 Flaw: What to Check

Updated November 12, 2026. A news analysis built from the Apache HTTP Server Project’s own security page and download page, Wiz’s blog post of November 11, 2026, our own screenshots of those pages, and the Hacker News front page. Disclosure: this story credits Anthropic’s OSS Scanner as one of the finders, and the research and drafting tools we use for these articles include Claude, an AI model made by Anthropic. We therefore rely on Apache’s own advisory, quote only what the pages say, and label every number we compute as ours. We did not test the vulnerability and this article contains no exploit details. This is not security consulting; check your own systems and your vendor’s advisories.

The short version

On November 11, 2026, the Apache HTTP Server Project released version 2.4.71. Its security page lists three vulnerabilities fixed in that release, one rated critical, one important and one low. The critical one is CVE-2026-119618, described as “mod_http2: heap corruption and RCE in assign_headers”: a concurrency flaw in the HTTP/2 module that Apache says “can lead to RCE”, meaning remote code execution. Apache lists it as affecting Apache HTTP Server from 2.4.55 through 2.4.70, and the standalone mod_h2 module from GitHub from 2.0.8 through 2.0.42.

Wiz, a cloud security company, published an explainer the same day. It says that at the time of writing no exploit was available and there were no reports of exploitation in the wild, and that its own data shows 64 percent of the cloud environments it sees have resources vulnerable to the flaw. Both sources say the fix is to upgrade to 2.4.71 or later, and Wiz gives a temporary mitigation if you cannot patch right away: restrict the server to HTTP/1.1 so the HTTP/2 module is not reachable. Below we separate what Apache says from what Wiz says, point out two inconsistencies in the Wiz post, show our arithmetic, and give a checklist for site owners and administrators.

Timeline

• September 29, 2026: the mod_md issue (CVE-2026-106023) is reported to the Apache security team.
• October 26, 2026: Anthropic reports the mod_http2 flaw to the Apache security team (date from Apache’s table).
• November 3, 2026: Google’s team reports the same flaw to the security team (Apache’s table lists the finder as Anthony Weems and Simon Scannell of the Google Cloud Vulnerability Research team).
• November 11, 2026: the fix is committed to the 2.4.x branch and Apache HTTP Server 2.4.71 is released the same day. Wiz publishes its explainer. The download page now calls 2.4.71 the latest available version and says it is recommended over all previous releases.
• November 12, 2026: the Wiz post is on the Hacker News front page, with 46 points about two hours after it was posted when we looked.

What Apache’s advisory says

The Apache security page is the primary source, so we start there. For release 2.4.71 it lists these three entries:

For the critical entry, the acknowledgements credit two finders: “Anthropic’s OSS Scanner, as vulnerability ANT-2026-MAPKT6MZ” and Anthony Weems and Simon Scannell of the Google Cloud Vulnerability Research team. The mod_md entry credits researchers from the 360 Vulnerability Research Institute (working with 360 TuLongFeng), Lucian Nitescu and Bartlomiej Dmitruk of striga.ai. The low-rated entry credits several individuals, including people from CloudLinux and TuxCare. Apache’s page does not publish a CVSS score in the text we read, only its own severity words.

The Apache page also lists recent releases with their CVE counts: 2.4.71 (November 2026, 3 CVEs), 2.4.69 (October 2026, 20 CVEs), 2.4.68 (June 2026, 13 CVEs), 2.4.67 (May 2026, 11 CVEs) and 2.4.66 (December 2025, 5 CVEs), out of 44 releases in the 2.4 line.

What Wiz adds, and where it is inconsistent

Wiz’s explainer says the flaw is a race condition in the assign_headers() function when handling shared resources, that a remote, unauthenticated attacker who successfully exploited it could corrupt heap memory and achieve arbitrary code execution, and that code would run with the privileges of the web server process. It says that as of publication no exploit is available and there are no reports of in-the-wild exploitation. Its cloud data: 64 percent of cloud environments have resources vulnerable to CVE-2026-119618, and 51 percent have publicly exposed instances, with the caveat that the figures “do not take configuration into account”. That caveat matters, because the flaw only applies where HTTP/2 is in use.

Two details in the Wiz post do not match Apache’s page, and readers should rely on Apache for them:

• One heading in the Wiz post asks “What is CVE-2026-111497?” while the rest of the post, and Apache, use CVE-2026-119618. The title graphic and body use 119618, so we treat 111497 as a typo, but you should copy the identifier from Apache when you search your scanners.
• The Wiz table lists the affected mod_h2 range as 2.0.8 through 2.0.42 but the patched version as “2.0.24 and newer”. A patched version lower than the last affected version cannot be right. Wiz’s own text elsewhere says to upgrade to a version newer than 2.0.42. Apache’s page lists only the affected range.

Our own arithmetic (labelled as ours)

The 16-day figure measures time between the first report Apache lists and the release; it does not measure how long the flaw existed in code. The affected range starts at 2.4.55, which tells you the code path has been present across many releases, but we do not know when it was introduced, and we are not guessing at dates.

Claimed versus what we could verify

Who is actually exposed

Three conditions have to line up for CVE-2026-119618 to matter to you, based on Apache’s and Wiz’s descriptions: you run Apache HTTP Server (or the standalone mod_h2 module) in an affected version, HTTP/2 is enabled, and the server is reachable by the attacker. Wiz’s phrasing is “deployments utilizing HTTP/2 capabilities”. If your site sits behind a different web server or a CDN that terminates HTTP/2 itself, your origin may not expose the vulnerable module to the internet, but we cannot tell your architecture from here.

For readers on shared hosting or managed WordPress hosting, the patching is your host’s job, not yours. What you can do is ask. A short message to support, asking whether the servers use Apache HTTP Server with HTTP/2, which version they run and when they will move to 2.4.71 or an equivalent patched build, is a reasonable request after a critical advisory. Our own site’s public responses identify the server as LiteSpeed, but a response header cannot tell us what runs elsewhere in our host’s infrastructure, so we do not know whether Apache HTTP Server sits anywhere in that chain.

For readers who run their own servers, packaging matters. Many Linux distributions apply security fixes to an older version number instead of shipping the newest upstream release, so a version string such as 2.4.58 does not by itself tell you whether you are protected. This is our general operations knowledge rather than something Apache or Wiz says in these pages: check your distribution’s security advisory for CVE-2026-119618 and the package changelog before deciding. The same applies to container images and appliances that bundle Apache.

Why this one is getting attention

Three things stand out. First, the rating: Apache calls it critical, which is the top of its own scale, and the impact it describes is remote code execution. Second, the reach: HTTP/2 is widely enabled, and the affected range spans 16 version numbers. Third, the finders: an automated scanner from Anthropic and a human research team at Google Cloud found it independently, eight days apart in the reporting dates. Wiz says “independently discovered”, and Apache’s table shows two reports on different dates, which is consistent with that.

The second point is a reminder that a bug found by one team may be found by others, which is a reason to patch promptly even when no exploitation is reported. It also shows how quickly fixes now follow reports: the release came 16 days after the first report and 8 days after the second, by our arithmetic. For background on how Anthropic describes its security safeguards in a different context, see our Claude Fable 5.2 analysis; we mention it only because the company is credited here, not because the stories are linked.

Checklist for site owners and administrators

1. Find out whether you run Apache HTTP Server at all, including behind a load balancer, in containers and on appliances.
2. Check the version. Affected is 2.4.55 through 2.4.70 per Apache; 2.4.71 or later is the fixed upstream release.
3. Check whether HTTP/2 is enabled. Look for the http2 module and for h2 or h2c in your Protocols setting.
4. Patch. Install 2.4.71 or your distribution’s patched package, then restart or reload as your vendor instructs.
5. If you cannot patch today, consider Wiz’s temporary mitigation of restricting the server to HTTP/1.1, accepting that it removes HTTP/2 performance benefits. Test it first and revert when you patch.
6. Do not rely on the version string alone for distribution packages; read the vendor’s advisory.
7. Standalone mod_h2 users: upgrade to a version newer than 2.0.42, and confirm the exact fixed number with the upstream project because Wiz’s post is inconsistent.
8. Check the other two fixes in 2.4.71: mod_md (2.4.30 through 2.4.70) and mod_vhost_alias (2.4.69 and 2.4.70) if you use those modules.
9. Review logs and alerting around your web servers, and keep backups current, in case a later report of exploitation changes the picture.
10. If you are on shared or managed hosting, ask your provider for its status instead of changing anything yourself.

What to watch next

• Whether proof-of-concept code or in-the-wild exploitation is reported, which would change the urgency from “patch soon” to “patch now”.
• Distribution and hosting-provider advisories that map CVE-2026-119618 to their package versions.
• Corrections to the Wiz post (the CVE heading and the mod_h2 patched version) or a clarification from the mod_h2 project.
• An official NVD or CVE.org record with a CVSS score, which Apache’s page does not show in the text we read.
• Whether the single security release and the 3-CVE count remain accurate as Apache updates its page.

For related reading, see our notes on the Gemini Decisions API and AWS Emulator for other developer-infrastructure stories this week, and on Claude Whiteboards, Sheets and Data. Browse our hosting tool reviews, our news section and all tool reviews.

Frequently asked questions

What is CVE-2026-119618?

A critical vulnerability in the mod_http2 module of Apache HTTP Server, described by Apache as heap corruption and RCE in assign_headers, caused by improper synchronization of concurrent execution.

Which versions are affected?

Apache HTTP Server from 2.4.55 through 2.4.70, and the standalone mod_h2 module from GitHub from 2.0.8 through 2.0.42, according to Apache.

Which version fixes it?

Apache HTTP Server 2.4.71, released November 11, 2026. Distribution packages may carry the fix under a different version number, so check your vendor’s advisory.

Is it being exploited?

Wiz said at the time of its post that no exploit was available and there were no reports of exploitation in the wild. That can change, so patch without waiting.

Am I affected if I use HTTP/1.1 only?

Wiz recommends restricting to HTTP/1.1 as a temporary mitigation because the vulnerable code is in the HTTP/2 module. Verify your own configuration and patch anyway.

I use shared or managed WordPress hosting. What should I do?

Patching is your provider’s job. Ask support whether they run Apache with HTTP/2, which version, and their timeline.

Who found the flaw?

Apache credits Anthropic’s OSS Scanner and Anthony Weems and Simon Scannell of the Google Cloud Vulnerability Research team.

Is this a hands-on test?

No. We read Apache’s and Wiz’s pages and did not test the vulnerability or any patched build.

Sources and method

• Apache HTTP Server Project, “Apache HTTP Server 2.4 vulnerabilities”, httpd.apache.org/security/vulnerabilities_24.html, read November 12, 2026.
• Apache HTTP Server Project, “Download”, httpd.apache.org/download.cgi, read November 12, 2026.
• Wiz, “Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know”, wiz.io/blog, dated November 11, 2026, read November 12, 2026.
• Hacker News front page, November 12, 2026.

Method: we read Apache’s 2.4.71 entries in full, read the Wiz post in full, captured the three screenshots above ourselves (the Wiz page showed a cookie banner, which we left untouched and cropped out of the image), and did all arithmetic by hand from the dates and counts shown. We did not test the flaw, download any release, or check any server other than reading our own site’s response headers.

Risk note

Security facts change quickly: exploit code, ratings and fixed-version numbers can be updated after we publish. Check Apache’s page and your vendor’s advisory before acting. This article is information, not security, legal or purchasing advice. ToolReviewHub may earn commissions from some tools reviewed elsewhere on the site; no affiliate link appears in this article, and the companies named here did not pay for or review it.