# Apache HTTP Server CVE-2026-119618 (mod_http2 assign_headers race): hunting and checking pack

CybaVerse pack, 12 Nov 2026. All times are GMT (UK time, UTC+0). Sources were fetched at 06:06 GMT on 12 Nov 2026 and
rechecked at the end of the build (see "Rechecked at finish").

## What Apache says (credited to the Apache HTTP Server project)

- **What:** "Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP
  Server's mod_http2 in assign_headers() can lead to RCE." Title: "mod_http2: heap corruption and RCE in assign_headers".
  Weakness CWE-362.
- **Severity:** Apache rates it critical (no CVSS score published by Apache or NVD). This pack never states a number.
- **Affected (Apache):** Apache HTTP Server 2.4.55 through 2.4.70, and releases of mod_h2 from GitHub 2.0.8 through 2.0.42.
- **Fixed:** Apache HTTP Server 2.4.71, released 11 Nov 2026 (fix commit 824beab9b9424d6cfb29595248fdbf6c3dddeab1).
- **Workaround:** Apache publishes none. Its advisory does not mention configuration, HTTP/2 enablement or
  authentication.
- **Credit:** found and reported by security researchers (first report 26 Oct 2026), credited by Apache.

Apache's own advice is to upgrade to 2.4.71.

## Timeline (GMT)

| When | What | Source |
|---|---|---|
| 26 Oct 2026 | First report to the Apache security team | Apache advisory |
| 11 Nov 2026 | httpd 2.4.71 released | httpd.apache.org |
| 11 Nov 2026, 12:19 | Apache posts the advisory to oss-security (2026/11/11/13), "Severity: critical" | oss-security |
| 11 Nov 2026, 12:52 | Red Hat publishes its CVE page and fixed packages for RHEL 9 and 10 | Red Hat |
| 11 Nov 2026, 14:54 | CVE record published by Apache as CNA; severity "critical" as text, no CVSS | cve.org |
| 11 Nov 2026, 15:17 | NVD receives the CVE; status Received, no NVD or CNA score (last modified 19:17) | NVD |
| 12 Nov 2026, 06:06 | Not in the CISA KEV catalog (catalog 2026.11.10, released 10 Nov 19:03) | CISA KEV |

## What others say (not Apache)

- **Red Hat** (vendor, 11 Nov): says the flaw is reachable without authentication and that "only servers that have
  HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable" (h2 or h2c via the
  Protocols directive). Red Hat publishes its own CVSS score, rates the flaw Critical overall but Important on RHEL 9 and
  RHEL 10 (their mod_http2 builds give each HTTP/2 stream its own allocator, which makes an attack much harder), says
  RHEL 6, 7 and 8 do not contain the vulnerable code, and uses CWE-20 rather than Apache's CWE-362. We do not repeat its
  score or its exploit statement in this pack: Apache publishes no score, and no exploit has been published or linked.
- **Amazon Linux** shows the same score as Red Hat (copied from Red Hat's data).
- **Press** (The Hacker News, 12 Nov) repeats Red Hat's "unauthenticated" and "HTTP/2 only" statements and Red Hat's
  score. The press claim "unauthenticated" therefore comes from Red Hat, not from Apache.
- **No exploitation reported:** not in KEV at the time of writing; no public exploit or indicators of compromise have
  been published.

## Distribution and vendor builds (backports)

Distributions ship fixes under their own package versions. A version string in the 2.4.55 to 2.4.70 range on a
distro build is **not** proof of exposure; check the distro advisory.

| Platform | Status (12 Nov 2026, 06:07 GMT) | Fixed package |
|---|---|---|
| Apache HTTP Server project releases | Fixed | 2.4.71 |
| RHEL 10 | Fixed, RHSA-2026:98978 (Red Hat: important) | mod_http2-2.0.29-5.el10_3.1 |
| RHEL 9 | Fixed, RHSA-2026:98981 (Red Hat: important) | mod_http2-2.0.26-7.el9_9.1 |
| RHEL 10 EUS (minor releases 0 and 2), RHEL 9 EUS (minor releases 6 and 8), RHEL 9 Update Services for SAP (minor release 4) | Fixed (RHSA-2026:98953, 98979, 98954, 98982, 98968) | see each advisory |
| RHEL 6, 7, 8 | Not affected | none needed |
| Red Hat JBoss Core Services, Red Hat Hardened Images | Affected, no fix listed | none listed |
| Debian sid | Fixed | apache2 2.4.71-1 |
| Debian bookworm, trixie, forky | Vulnerable (bug 1153732) | none listed |
| Amazon Linux 2, 2023, 2027 Preview | Pending fix | none listed |
| Ubuntu | No CVE page yet (404) | UNVERIFIED |
| SUSE | No CVE page yet (404) | UNVERIFIED |

Bundled Apache (cPanel and other hosting panels, XAMPP, Apache Lounge builds, network and storage appliances) follows
its vendor's release schedule, not Apache's.

## The two other CVEs fixed in 2.4.71 (brief)

- **CVE-2026-106023**, mod_md NULL pointer dereference, child process crash. Apache: important. Apache says 2.4.30
  through 2.4.70.
- **CVE-2026-109163**, mod_vhost_alias 1 byte stack buffer overwrite. Apache: low. Apache says 2.4.69 and 2.4.70.
- **Conflict recorded:** the description text in the CVE records (cve.org and NVD) says "2.4.30 through 2.4.69" and
  "2.4.69" respectively, while the structured version data in the same records and the Apache advisory and CHANGES
  file say through 2.4.70. This pack follows Apache (through 2.4.70).

## Standalone mod_h2 (GitHub)

The last mod_h2 release on GitHub is v2.0.42 (29 May 2026), which is inside the affected range. There is no fixed
standalone release, and the repository was archived (read-only) on 9 Jun 2026. Servers that use a standalone mod_h2
build should move to httpd 2.4.71 with its bundled mod_http2, or turn HTTP/2 off (see our advice).

## Our advice (OUR ADVICE, CybaVerse)

Not Apache guidance. Apache's only advice is the upgrade to 2.4.71.

1. **Patch internet-facing servers first**, then internal ones: upstream builds to 2.4.71, distro builds to the
   distro's fixed package, bundled builds to the vendor's fixed release.
2. **Stopgap if you cannot patch today:** remove h2 and h2c from every Protocols directive (server-wide and every
   virtual host), leaving `Protocols http/1.1`, or stop loading mod_http2 (comment out `LoadModule http2_module`, or
   `a2dismod http2` on Debian and Ubuntu), then reload. This rests on our reading that the bug is in the HTTP/2 module
   (Apache's advisory does not discuss configuration; Red Hat says HTTP/1.1-only servers are not affected). Patch
   anyway.
3. **A front proxy, load balancer or CDN only helps if it speaks HTTP/1.1 to the backend.** If it forwards HTTP/2
   (h2 or h2c) to Apache, the backend is still exposed. Check the backend protocol setting, not just the edge.
4. **Find bundled Apache:** hosting panels, XAMPP and Apache Lounge installs on Windows, and appliances (NAS, firewalls,
   management consoles) that embed httpd. Ask the vendor for a fixed build and use the stopgap until then.
5. **Run the checkers** (scripts/) on each server and the inventory hunts (Q1 to Q1d) in Defender.
6. **Reactive steps** if a server ran an affected build with HTTP/2 on: review the Q2 to Q5c hunts for that host since
   11 Nov 2026 (and earlier, as the bug was reported on 26 Oct); look for new files in the web root, new modules or
   config, unexpected child processes of httpd, outbound connections from httpd, and crashes. If anything is found,
   isolate the host, preserve memory and disk, rotate credentials and keys the web server could read (TLS keys,
   application secrets), and rebuild from a known good image.
7. **Watch KEV and the vendor pages**: if exploitation is reported, move the stopgap to every server immediately.

## Contents

- `kql/apache-httpd-mod-http2-cve-2026-119618-hunting.kql`: 13 hunts for Microsoft Defender XDR and Microsoft Sentinel.
  - INVENTORY: Q1 (software inventory with range check), Q1b (CVE mapping for all three CVEs), Q1c (web server
    processes), Q1d (mod_http2 module files).
  - OUR PATTERN: Q2 (web server spawning shells or downloaders), Q2b (grandchildren), Q3 (scripts or binaries written
    into web roots), Q3b (module or config changes outside package managers), Q4 (outbound connections from httpd),
    Q4b (outbound from its children), Q5 (Syslog crash patterns, generic, not signatures), Q5b (Windows event 1000 for
    httpd.exe), Q5c (process start spikes).
- `sigma/`: 4 rules, all OUR PATTERN (generic post-exploitation behaviour, not a signature of this CVE):
  `proc_creation_lnx_apache_spawns_shell_or_downloader.yml`, `proc_creation_win_apache_spawns_shell.yml`,
  `file_event_lnx_apache_writes_script_to_webroot.yml`, `file_event_win_apache_writes_script_to_webroot.yml`.
  `sigma/converted/` holds Kusto conversions for no pipeline, microsoft_xdr, microsoft_365_defender, sentinel_asim and
  azure_monitor; all 4 rules convert on every pipeline.
- `scripts/check-httpd-cve-2026-119618.sh` (Linux, bash) and `scripts/Check-HttpdCve2026119618.ps1` (Windows Apache
  such as XAMPP or Apache Lounge, PowerShell 7). Same output and exit codes.
- `tests/`: bash tests, Pester tests with parity, fixtures (all synthetic, FIXTURE_ONLY), `run_all.sh`.

## The checkers

Offline and read-only: no network, no writes, no payloads, nothing sent to the server. They read files you pass:

```
# Linux
httpd -v > v.txt; httpd -M > m.txt          # or apache2ctl -v / apache2ctl -M
rpm -qa > p.txt                             # or dpkg -l > p.txt
bash scripts/check-httpd-cve-2026-119618.sh --version-output v.txt --modules m.txt --config /etc/httpd --packages p.txt
bash scripts/check-httpd-cve-2026-119618.sh --local          # reads the usual Linux paths itself
# Windows
pwsh -File scripts/Check-HttpdCve2026119618.ps1 --binary C:\xampp\apache\bin\httpd.exe --config C:\xampp\apache\conf
pwsh -File scripts/Check-HttpdCve2026119618.ps1 --local      # XAMPP, Apache24
```

Other options: `--binary` (reads the version string from the httpd binary), `--mod-h2 VERSION` (standalone mod_h2),
`--name LABEL`.

| Verdict | Exit | Meaning |
|---|---|---|
| VULNERABLE | 1 | Upstream build 2.4.55 to 2.4.70, or standalone mod_h2 2.0.8 to 2.0.42, and HTTP/2 not shown to be off |
| NOT EXPOSED | 0 | HTTP/2 is off (mod_http2 not loaded, or no Protocols line with h2 or h2c). OUR INFERENCE, see below |
| PATCHED | 0 | Upstream 2.4.71 or later |
| NOT AFFECTED | 0 | Outside the affected ranges |
| DISTRO BACKPORT CHECK | 5 | Distro or vendor build (build tag or package list): check the distro advisory, version strings are not enough |
| UNKNOWN | 3 | No usable version |
| (usage or read error) | 4 | Nothing printed on stdout |

**NOT EXPOSED is OUR INFERENCE.** Apache's advisory does not say exposure needs HTTP/2. We infer it because the bug is
in mod_http2, Apache documents `Protocols http/1.1` as the default with h2 and h2c needed for HTTP/2, and Red Hat states
that HTTP/1.1-only servers are not affected. The checker still tells you to update an in-range version. Config checks
read only the files under the path you give (Include targets elsewhere are not followed, Debian `*-available` folders
are skipped), so pass `httpd -M` output where you can.

The checkers also print SECONDARY lines for CVE-2026-106023 and CVE-2026-109163 on upstream builds in their ranges.

## Caveats and UNVERIFIED items

- The KQL in this pack has NOT been run against a live tenant. It parses offline (Kusto.Language) against an assumed
  schema subset. Defender software names for Apache (vendor apache, name http_server) are UNVERIFIED, and Defender's
  CVE mapping for these new CVEs may lag.
- The hunts and Sigma rules are OUR PATTERN: generic behaviour after a web server compromise. No indicators of
  compromise or crash signatures have been published for this CVE; the Syslog patterns are generic and ours.
- Ubuntu and SUSE had no CVE pages when checked (404): UNVERIFIED whether or when they ship fixes.
- Red Hat's statement about demonstrated exploit research is not backed by any published or linked research we
  could find; we do not repeat it.
- Exposure through HTTP/2 only (NOT EXPOSED) is our inference and Red Hat's statement, not Apache's.

## Rechecked at finish (12 Nov 2026, 06:25 GMT)

- Apache advisory: unchanged (ranges, severity rating, no workaround, no score).
- NVD: all three CVEs still Received with no score (CVE-2026-119618 last modified 11 Nov, 19:17).
- CISA KEV: catalog 2026.11.10 is still the latest; none of the three CVEs is listed.
- mod_h2 on GitHub: latest release still v2.0.42.
- Ubuntu and SUSE CVE pages: still 404. Red Hat and Debian pages: unchanged in substance.