Have you patched Apache HTTP Server for CVE-2026-119618?
Apache has published CVE-2026-119618, rated critical, in HTTP Server 2.4.55 through 2.4.70. It is a CWE-362 race in mod_http2's assign_headers() that, Apache says, can lead to RCE. The fix is 2.4.71, released 11 November 2026. Apache and NVD have published no CVSS score. Standalone GitHub builds of mod_h2 from 2.0.8 through 2.0.42 are also affected, and there is no standalone fix. Update to 2.4.71 now.
Rated critical by Apache. Apache and NVD have published no CVSS score. Update to 2.4.71. No exploitation reported when we checked.
Apache's HTTP Server 2.4 advisory rates CVE-2026-119618 critical. It describes a CWE-362 concurrent-execution flaw in mod_http2's assign_headers() that, in Apache's words, "can lead to RCE". Affected releases are HTTP Server 2.4.55 through 2.4.70, and standalone GitHub builds of mod_h2 from 2.0.8 through 2.0.42. The fix is 2.4.71, released 11 November 2026. Apache and NVD have published no CVSS score. We quote no other vendor's number.
By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 12 November 2026, 06:34 GMT.
At a Glance
Based on the Apache HTTP Server 2.4 advisory, the official CVE record, the oss-security announcement, NVD, Red Hat's CVE page and distribution trackers, re-checked at 06:31 GMT on 12 November 2026. Last updated 12 November 2026, 06:34 GMT.
Critical (Apache)
Apache rates CVE-2026-119618 critical in its 2.4 advisory, the official CVE record and the oss-security announcement. That is a textual rating, not a CVSS score. Apache and NVD have published no CVSS score. NVD status was still Received when we re-checked at 06:31 GMT on 12 November 2026. We quote no number.
2.4.55 through 2.4.70
Apache says this issue affects HTTP Server 2.4.55 through 2.4.70, and standalone GitHub builds of mod_h2 from 2.0.8 through 2.0.42. The flaw is in mod_http2 (CWE-362). Apache and oss-security do not say that HTTP/2 must be enabled, and do not say that no authentication is needed. Red Hat's CVE page says only servers that have HTTP/2 enabled are affected, and that a remote attacker who can reach the server could exploit the flaw without any authentication.
2.4.71, released 11 Nov 2026
Apache released HTTP Server 2.4.71 on 11 November 2026 to fix this CVE, and published no workaround. Standalone mod_h2 has no later fixed release; move those servers to the bundled module in 2.4.71. Distributions often backport fixes under their own package numbers, so check your distro advisory rather than the upstream version string alone.
None reported; not in CISA KEV
Apache has not reported exploitation. The CVE was not in the CISA Known Exploited Vulnerabilities catalogue when we re-checked at 06:31 GMT on 12 November 2026 (catalogue version 2026.11.10, released 10 November 2026, 19:03 GMT).
Apache's advisory records that the issue was reported to its security team on 26 October 2026.
The oss-security announcement for CVE-2026-119618 is sent, with severity critical, and points to Apache's 2.4 advisory.
Red Hat publishes its CVE page. It states that only servers with HTTP/2 enabled are affected, and that the flaw can be exploited without authentication.
The official CVE record is published. The assigner is Apache. Severity is recorded as a textual rating of critical, with no CVSS score.
Apache releases HTTP Server 2.4.71, fixing CVE-2026-119618 and two lower-severity issues in the same release. Red Hat issues RHSA-2026:98981 for Enterprise Linux 9 and RHSA-2026:98978 for Enterprise Linux 10.
We re-checked the Apache advisory, the CVE record, oss-security, NVD, Red Hat's CVE page, the listed distribution trackers and the CISA KEV catalogue. NVD had still published no CVSS score. The CVE was not in KEV. Recheck the Apache 2.4 list and your distro advisory.
What Apache describes
Apache's title for CVE-2026-119618 is "mod_http2: heap corruption and RCE in assign_headers". The advisory, the official CVE record and the oss-security announcement use the same description: a concurrent execution using shared resource with improper synchronization vulnerability (CWE-362) in Apache HTTP Server's mod_http2, in assign_headers(), "can lead to RCE". Apache rates it critical. It affects HTTP Server 2.4.55 through 2.4.70, and affected releases of mod_h2 from GitHub from 2.0.8 through 2.0.42. The fix named by Apache is 2.4.71, released 11 November 2026. Apache published no workaround, and Apache and NVD have published no CVSS score. Apache's advisory records that the issue was reported to its security team on 26 October 2026. Credit on the official record is to security researchers; we do not name them here.
The same 2.4.71 release also fixes two lower-severity issues, which we mention once and do not treat as the reason to act: CVE-2026-106023, an important NULL pointer dereference in mod_md, affecting 2.4.30 through 2.4.70; and CVE-2026-109163, a low 1-byte stack buffer overwrite in mod_vhost_alias, affecting 2.4.69 and 2.4.70. Those version ranges follow Apache. The structured version data in the official CVE records and in NVD agree with Apache, even where those records' description text is narrower.
What Red Hat's CVE page says, and what Apache does not
Red Hat's CVE page for CVE-2026-119618, public at 12:52 GMT on 11 November 2026, says: "Only servers that have HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable." It also says a remote attacker who can reach the web server could exploit the flaw "without any authentication," and that the issue affects servers with HTTP/2 (h2 or h2c) enabled via the Protocols directive. Apache's advisory and the oss-security announcement say neither of those things. We credit those two claims to Red Hat, not to Apache, and not to press reports that repeat them.
When we checked at 06:31 GMT on 12 November 2026, the last standalone GitHub release of mod_h2 was still v2.0.42 (29 May 2026), which Apache lists as affected, and the repository had been archived (read-only) on 9 June 2026. There is no later fixed standalone release. Servers that use a standalone mod_h2 build should move to HTTP Server 2.4.71 and its bundled mod_http2, or use the stopgap below until they can.
Distribution status (checked 12 November 2026, 06:31 GMT)
Check your vendor's advisory, not the upstream version string alone. Status below is what those trackers showed at the check time.
| Platform | Status when we checked |
|---|---|
| Apache HTTP Server project releases | Fixed in 2.4.71, released 11 November 2026 |
| Red Hat Enterprise Linux 9 | Fixed: mod_http2-2.0.26-7.el9_9.1 (RHSA-2026:98981) |
| Red Hat Enterprise Linux 10 | Fixed: mod_http2-2.0.29-5.el10_3.1 (RHSA-2026:98978) |
| Red Hat Enterprise Linux 6, 7 and 8 | Not affected (Red Hat: vulnerable code not present) |
| Red Hat JBoss Core Services | Affected; no fix listed |
| Red Hat Hardened Images | Affected; no fix listed |
| Debian sid | Fixed: apache2 2.4.71-1 (Debian security tracker) |
| Debian bookworm, trixie and forky | Vulnerable (Debian security tracker) |
| Amazon Linux 2, 2023 and 2027 Preview | Pending fix (Amazon Linux Security Center) |
| Ubuntu | No CVE page published when we checked at 06:31 GMT |
| SUSE | No CVE page published when we checked at 06:31 GMT |
What to Do in the Next 24 Hours
Proactive on the left. Reactive on the right. Vendor steps and our advice are labelled separately.
Patch first, then reduce exposure
- Apache: update Apache HTTP Server to 2.4.71, the release that fixes CVE-2026-119618.
- Our advice: patch internet-facing servers first. If you use a distribution build, install the fixed package your vendor has issued; do not rely on the upstream version string alone. Look for bundled Apache in hosting panels, XAMPP, Apache Lounge builds, and appliances.
- Our advice: if you cannot update yet, a stopgap is to remove h2 and h2c from Protocols (server-wide and every virtual host), or unload mod_http2. A front proxy or CDN only helps if it talks HTTP/1.1 to the backend. This stopgap is ours, not Apache's. Apache published no workaround.
- Our advice: if you run a standalone mod_h2 build, move to HTTP Server 2.4.71 and its bundled mod_http2. There is no later standalone fix. Run our checker, and treat a NOT EXPOSED verdict as our inference.
Hunt and contain
- Our advice: review the pack hunts back to 26 October 2026, when Apache records the issue as first reported. Look for child process crashes on HTTP/2 servers, shells, curl or wget started as the Apache user, new files under the web root, and unusual outbound connections from the server.
- Our advice: if you see those signs, isolate the host, keep logs and memory, rebuild on 2.4.71 rather than only restarting the service, and rotate credentials that the server could have exposed.
- Our advice: Apache has published no indicators of compromise. Those hunts are our patterns, not vendor detections. CybaOps can help you hunt and contain.
Proactive: Vendor Steps, Then Ours
Apache's advice first, then our advice. Our inventory checks and stopgap are not a substitute for the official 2.4.71 update, and Apache published no workaround.
Update to 2.4.71
Apache's advice, from the 11 November 2026 HTTP Server 2.4 advisory: this issue is fixed in Apache HTTP Server 2.4.71. Update to that release. The same advisory lists the affected range as 2.4.55 through 2.4.70, and standalone GitHub builds of mod_h2 from 2.0.8 through 2.0.42.
Patch internet-facing servers first, and check distro or bundled builds
Our advice, not Apache's wording: patch internet-facing Apache HTTP Server instances first, then internal ones. If you install httpd from a Linux or other distribution, check that vendor's advisory and install the fixed package it names. Also find bundled Apache in hosting panels, XAMPP, Apache Lounge builds, and appliances (for example NAS, firewall or management consoles), and ask that vendor for a fixed build.
Standalone mod_h2 has no later fix
Our advice: if you run a standalone GitHub build of mod_h2, move to HTTP Server 2.4.71 and its bundled mod_http2. When we checked at 06:31 GMT on 12 November 2026, the last standalone release was still v2.0.42, inside Apache's affected range, and the repository had been archived on 9 June 2026. There is no later fixed standalone release.
Stopgap if you cannot update yet
Our advice, not Apache's, and not credited to any other firm: if you cannot move to 2.4.71 immediately, remove h2 and h2c from the Protocols directive on the main server and every virtual host, leaving HTTP/1.1, or unload mod_http2. A front proxy, load balancer or CDN only helps if it talks HTTP/1.1 to the backend; if it forwards HTTP/2, the backend can still be reached with HTTP/2. Apache published no workaround. This is a temporary reduction in exposure, not the fix. Update to 2.4.71, or your distro's fixed package, as soon as you can.
Free Detection Pack
Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check exposure offline and hunt for signs of misuse. Everything is read-only.
check-httpd-cve-2026-119618.sh
Read-only, offline checker. It reads a version string, httpd -M (or apache2ctl) output, a config directory and a package list, or the usual Linux paths with --local. It never contacts the server, writes nothing, runs nothing and contains no payloads.
bash check-httpd-cve-2026-119618.sh --localbash check-httpd-cve-2026-119618.sh --version-output v.txt --modules m.txt --config /etc/httpd --packages p.txtCheck-HttpdCve2026119618.ps1
The same checks in PowerShell 7, with identical output and exit codes, for Windows builds such as XAMPP or Apache Lounge. --local reads the usual install paths, still read-only.
pwsh -File Check-HttpdCve2026119618.ps1 --localKQL and Sigma
13 KQL hunts (Q1 to Q1d inventory; Q2 to Q5c our patterns). 4 Sigma rules, all our patterns, with Kusto conversions included. None of the KQL has been run against a live tenant. The hunts and Sigma rules are generic post-compromise behaviour, not a signature of this CVE. Where a rule does not convert, use the KQL hunts.
Verdicts
- VULNERABLEAn upstream build in 2.4.55 through 2.4.70, or standalone mod_h2 in 2.0.8 through 2.0.42, and HTTP/2 is not shown to be off.
- NOT EXPOSEDHTTP/2 is off (mod_http2 not loaded, or no Protocols line with h2 or h2c). This verdict is our inference, not an Apache statement. The checker still tells you to update an in-range version.
- PATCHEDUpstream HTTP Server 2.4.71 or later.
- NOT AFFECTEDOutside the affected version ranges.
- DISTRO BACKPORT CHECKA distribution or vendor build. Check that vendor's advisory; the upstream version string is not enough.
- UNKNOWNNo usable version could be read.
Exit codes
| Code | Meaning |
|---|---|
| 0 | NOT EXPOSED, PATCHED or NOT AFFECTED |
| 1 | VULNERABLE |
| 5 | DISTRO BACKPORT CHECK |
| 3 | UNKNOWN |
| 4 | Usage or read error |
The full pack zip contains 56 files: 13 KQL hunts, 4 Sigma rules, both checkers, tests and the README.
Know the limits
- Both checkers are read-only and offline. They only read the files or local paths you point them at, send no network traffic, write nothing and contain no payloads.
- None of the KQL has been run against a live tenant. Tune it before relying on it.
- NOT EXPOSED is our inference. Apache's advisory does not say a server is only affected when HTTP/2 is enabled. We infer it because the flaw is in mod_http2, and because Red Hat's CVE page says only servers that have HTTP/2 enabled are affected. The checker still tells you to update an in-range version.
- Q2 to Q5c and all four Sigma rules are our patterns, not Apache's. Apache has published no indicators of compromise. A match is a lead, not proof of exploitation.
- Ubuntu and SUSE had no CVE pages when we checked at 06:31 GMT on 12 November 2026. Do not treat a missing page as a clean bill of health.
What is in the pack
| File | What it does |
|---|---|
| check-httpd-cve-2026-119618.sh | Read-only checker for Linux (bash) |
| Check-HttpdCve2026119618.ps1 | The same checker in PowerShell 7, for Windows builds such as XAMPP |
| KQL (13 hunts) | Q1 to Q1d inventory; Q2 to Q5c our patterns |
| Sigma (4 rules) | All our patterns; Kusto conversions included |
| tests/ | Fixtures and tests (in the full pack) |
| README.md | Verified facts, Apache vs Red Hat vs our advice, limits and usage |
Reactive: How to Hunt (Our Advice)
The hunts below are CybaVerse advice, our own patterns. Apache has published no indicators of compromise. None of the KQL has been run against a live tenant. CybaOps can run a hunt across your estate.
Review from 26 October 2026
Our advice: review the pack hunts, and your own logs, back to 26 October 2026, the date Apache records as the first report to its security team. Look for Apache child process segfaults or unexpected child exits, especially on servers that have HTTP/2 enabled. A crash alone does not prove exploitation, and absence of a crash does not prove you are safe.
Unexpected processes, web-root files and outbound connections
Our advice: look for shells, curl, wget or similar tools started as the Apache service user, new or unexpected files under the web root, and unusual outbound connections from the web server host. These are our patterns, not official Apache indicators, and a match is a lead to investigate rather than proof on its own. The pack includes 13 KQL hunts and 4 Sigma rules; none of the KQL has been run against a live tenant.
If you find signs of compromise
Our advice: isolate the affected host, and keep logs and memory before cleanup. Rebuild the server on Apache HTTP Server 2.4.71 (or your distro's fixed package) rather than only restarting the service. Rotate credentials that the server could have exposed, including application secrets and keys it could read. Start incident response for every service that host could reach. CybaOps can help you hunt and contain.
If you find signs of compromise (our advice)
- Isolate the host and preserve logs and memory before cleanup.
- Rebuild on Apache HTTP Server 2.4.71, or on the fixed package your distribution has issued, rather than only restarting httpd.
- Rotate credentials and secrets the server could have exposed.
- Hunt other Apache HTTP Server instances, especially internet-facing ones still on 2.4.55 through 2.4.70, and review activity back to 26 October 2026.
- CybaOps can help you hunt and contain.
Apache HTTP Server CVE-2026-119618 FAQ
Short answers based on the Apache HTTP Server 2.4 advisory, the official CVE record, the oss-security announcement, NVD, Red Hat's CVE page and distribution trackers, re-checked at 06:31 GMT on 12 November 2026.
What is CVE-2026-119618?
It is a CWE-362 flaw in Apache HTTP Server's mod_http2, in the assign_headers() function. Apache describes it as a concurrent execution using shared resource with improper synchronization vulnerability, titles it as heap corruption and RCE, and says it can lead to RCE. Apache rates it critical. It affects HTTP Server 2.4.55 through 2.4.70, and standalone GitHub builds of mod_h2 from 2.0.8 through 2.0.42. The fix is 2.4.71, released 11 November 2026. Apache's advisory records that the issue was reported to its security team on 26 October 2026.
How severe is it, and is there a CVSS score?
Apache rates it critical, in the 2.4 advisory, the official CVE record and the oss-security announcement. That is a textual rating. Apache and NVD have published no CVSS score. NVD status was still Received when we re-checked at 06:31 GMT on 12 November 2026. We quote no number.
Must HTTP/2 be enabled, and is authentication needed?
Apache and oss-security say neither. Red Hat's CVE page says only servers that have HTTP/2 enabled are affected, and that a remote attacker who can reach the server could exploit the flaw without any authentication. We credit those two claims to Red Hat, not to Apache. Our checker's NOT EXPOSED verdict, for HTTP/2 off, is our inference, even though it is consistent with Red Hat's statement. The checker still tells you to update an in-range version.
Which servers are affected, including distro and standalone builds?
Apache lists HTTP Server 2.4.55 through 2.4.70, and standalone GitHub mod_h2 2.0.8 through 2.0.42. There is no later standalone mod_h2 fix; the GitHub repository was archived on 9 June 2026, with 2.0.42 still the last release when we checked. For distribution builds, check the vendor advisory: when we checked at 06:31 GMT on 12 November 2026, RHEL 9 and 10 had fixed packages, RHEL 6, 7 and 8 were not affected, JBoss Core Services and Red Hat Hardened Images were affected with no fix listed, Debian sid was fixed, Debian bookworm, trixie and forky were vulnerable, Amazon Linux was pending a fix, and Ubuntu and SUSE had no CVE pages published.
Is it being exploited?
Apache has not reported exploitation. The CVE was not in the CISA Known Exploited Vulnerabilities catalogue when we re-checked at 06:31 GMT on 12 November 2026 (catalogue version 2026.11.10, released 10 November 2026). We make no claim of our own, and we have not seen a public proof-of-concept linked from the official advisory.
What should we do first?
Follow Apache first: update to HTTP Server 2.4.71. Our advice: patch internet-facing servers first; check distro advisories rather than the upstream version string alone; find bundled Apache in panels, XAMPP and appliances; if you cannot update yet, remove h2 and h2c from Protocols or unload mod_http2 (that stopgap is ours, not Apache's); a front proxy or CDN only helps if it talks HTTP/1.1 to the backend; and review hunts back to 26 October 2026.
Does 2.4.71 fix anything else?
Yes. The same 2.4.71 release also fixes CVE-2026-106023, an important NULL pointer dereference in mod_md (2.4.30 through 2.4.70), and CVE-2026-109163, a low 1-byte stack buffer overwrite in mod_vhost_alias (2.4.69 and 2.4.70). Those ranges follow Apache; the structured version data in the official CVE records and in NVD agree. We mention them once. CVE-2026-119618 is the critical issue and the reason to treat this update as urgent.
Patch the Server, Before Someone Else Reaches It
CybaOps monitors your servers, endpoints and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.
Sources
- Apache HTTP Server: 2.4 vulnerabilities list, CVE-2026-119618 (critical) and the 2.4.71 release notes (released 11 November 2026; first report to the security team recorded as 26 October 2026; re-checked 12 November 2026, 06:31 GMT)
- oss-security: CVE-2026-119618 announcement (11 November 2026, 12:19 GMT; severity: critical)
- Official CVE record: CVE-2026-119618 (published 11 November 2026, 14:54 GMT; assigner Apache; severity recorded as a textual rating of critical, with no CVSS score)
- NVD: CVE-2026-119618 (status Received, no CVSS metrics, when re-checked at 06:31 GMT on 12 November 2026)
- Red Hat: CVE-2026-119618 (public 11 November 2026, 12:52 GMT; states that only servers with HTTP/2 enabled are affected, and that the flaw can be exploited without authentication; re-checked 12 November 2026, 06:31 GMT)
- Red Hat: RHSA-2026:98981, Important mod_http2 security update for Red Hat Enterprise Linux 9 (fixed package mod_http2-2.0.26-7.el9_9.1; issued 11 November 2026)
- Red Hat: RHSA-2026:98978, Important mod_http2 security update for Red Hat Enterprise Linux 10 (fixed package mod_http2-2.0.29-5.el10_3.1; issued 11 November 2026)
- Debian security tracker: CVE-2026-119618 (sid fixed in apache2 2.4.71-1; bookworm, trixie and forky listed as vulnerable; checked 12 November 2026, 06:31 GMT)
- Amazon Linux Security Center: CVE-2026-119618 (Amazon Linux 2, 2023 and 2027 Preview listed as pending fix; checked 12 November 2026, 06:31 GMT)
- CISA Known Exploited Vulnerabilities catalogue (version 2026.11.10, released 10 November 2026, 19:03 GMT; re-checked 12 November 2026, 06:31 GMT; CVE-2026-119618 was not listed)