CVE-2026-119618: Race Condition in Apache mod_http2 Enables RCE

A race condition in Apache HTTP Server's mod_http2 module allows unauthenticated remote code execution on servers with HTTP/2 enabled. Version 2.4.71, released November 11, 2026, patches the flaw; HTTP/1.1-only deployments are not affected.

On November 11, 2026, the Apache project released HTTP Server 2.4.71, an update that fixes CVE-2026-119618: a critical-severity race condition in the mod_http2 module. The flaw can allow unauthenticated remote code execution on servers that have the HTTP/2 protocol enabled — a configuration Wiz Research estimates is present in 64% of cloud environments, with 51% of those instances publicly exposed.

Key Takeaways

The vulnerability resides in mod_http2's assign_headers() function: a worker thread and a connection thread race on a shared lock-free allocator without adequate synchronization, causing heap corruption.
Affected versions are Apache HTTP Server 2.4.55 through 2.4.70 and standalone mod_h2 2.0.8 through 2.0.42; the fix is in release 2.4.71.
Only servers with HTTP/2 actually enabled (h2 or h2c in the Protocols directive) are vulnerable; HTTP/1.1-only installations are immune by configuration.
Red Hat assigned a CVSS 9.8 Critical rating, though RHEL 9 and 10 use a separate per-stream allocator that increases exploit complexity and received an "Important" rating.

The Mechanism: A Race Condition at the Heart of Multiplexing

CVE-2026-119618 is classified as CWE-362, a race condition. The defect manifests in mod_http2's assign_headers() function, the module that handles the HTTP/2 protocol in Apache. When a worker thread processes a request and a connection thread manages the multiplexed stream, both access a shared data structure through a lock-free allocator. The missing synchronization allows one thread to write into memory allocated for the other, resulting in heap corruption.

The bug's nature is tied to HTTP/2's architecture. The protocol's multiplexing of streams over a single TCP connection introduces concurrency complexity in resource management that HTTP/1.1 does not have. Available sources do not specify the year mod_http2 was introduced into the Apache project.

The Discovery: Two Independent Teams, One Convergence

The vulnerability was independently identified by two research groups. Anthropic reported the bug on October 26, 2026, via its OSS Scanner tool; Google Cloud Vulnerability Research confirmed the finding on November 3. According to SecurityWeek, citing the Red Hat advisory, both reports contributed to the flaw's definition. The coordinated patch release occurred on November 11, with the commit published in the official Apache repository.

A proof-of-concept published on November 12 reproduces the heap corruption but, according to available sources, does not demonstrate full remote code execution. Security Boulevard indicated its research is focused on determining which configurations are exploitable.

The Attack Surface: Cloud and Configuration as Variables

Wiz Research published proprietary data illuminating the potential attack surface: 64% of monitored cloud environments contain resources with vulnerable Apache versions, and 51% of those environments have publicly exposed instances. The source explicitly states these data "do not account for configuration" — meaning they do not distinguish whether HTTP/2 is actually active.

This qualification is central. The vulnerability does not affect "all Apache servers" but only those with the Protocols directive including h2 or h2c. Disabling HTTP/2 — removing those directives — is documented as an effective temporary mitigation. Red Hat further clarified that RHEL 8 and earlier do not contain the vulnerable code, while RHEL 9 and 10, though technically affected, use a separate per-stream allocator that alters exploitability conditions.

"public research has demonstrated a reliable exploit against a default-configured server with mod_http2 enabled" — Red Hat advisory, cited by SecurityWeek

This Red Hat statement is in tension with other sources. Wiz Research stated that "no exploit is available and there are no reports of exploitation in the wild." At time of publication, no source has identified the public research cited by Red Hat.

What to Do Now

For system administrators running Apache HTTP Server in production, priority actions derive directly from available sources:

Verify HTTP/2 configuration: check whether the Protocols directive includes h2 or h2c; if so, the server is potentially vulnerable.
Upgrade to 2.4.71: the official patch released November 11, 2026, fixes the race condition in assign_headers().
Disable HTTP/2 as a temporary mitigation: removing h2/h2c from the Protocols directive blocks the attack vector until the patch is applied.
Monitor standalone mod_h2 versions: for installations using mod_h2 separately from the core server, versions 2.0.8 through 2.0.42 are vulnerable and require updating.

Source Limitations and Report Tensions

The technical details in this article rely on third-party citations (Red Hat, Apache advisory) not directly accessible in our excerpts. Wiz data are proprietary and not externally verifiable. The Red Hat claim of a "reliable exploit" is not independently verified and conflicts with Wiz and Horizon3 denials of available exploits.

2026 has seen five vulnerabilities in the mod_http2 module, according to data aggregated by SOCRadar. This frequency is documented in available sources; any interpretation of structural causes remains unverified industry analysis.

Closing

CVE-2026-119618 represents a concentrated criticality: high potential severity, an attack surface limited to active HTTP/2 configurations, and no confirmed exploits at time of publication. The 2.4.71 patch is available and temporary mitigation is documented. For administrators, the priority is verifying the Protocols configuration and planning the upgrade.

Sources

Sources and references

Get DeafLetter