Apache HTTP Server: Critical RCE Vulnerability ( CVE-2026-119618 )

The Apache Software Foundation has disclosed a critical vulnerability, CVE-2026-119618, in the HTTP/2 module (mod_http2) of Apache HTTP Server. The flaw is a race condition in the assign_headers() function, where concurrent threads access a shared header table without proper synchronization. A remote, unauthenticated attacker can exploit this to corrupt heap memory and potentially achieve remote code execution – no user interaction or prior access is required.

Apache rates the issue Critical, and Red Hat has assigned a CVSS 3.1 score of 9.8. The affected versions are Apache HTTP Server 2.4.55 through 2.4.70 and standalone mod_h2 2.0.8 through 2.0.42, when HTTP/2 (h2 or h2c) is enabled. Servers supporting only HTTP/1.1 are not affected. The issue is fixed in Apache HTTP Server 2.4.71, released on November 11, 2026, which also addresses two lower-severity issues (CVE-2026-106023 in mod_md and CVE-2026-109163 in mod_vhost_alias). No exploitation in the wild has been reported at the time of this notice, but public research reproducing the memory corruption is available.

NetSPI Product & Services Coverage  

NetSPI EASM: NetSPI’s External Attack Surface Management has released version-based detection for this vulnerability, which will be reported as Vulnerable Version – Apache HTTP Server RCE (CVE-2026-119618).
Because the exact Apache version is not always exposed externally, NetSPI also recommends conducting an internal review of any Apache HTTP servers.

NetSPI Penetration Testing: NetSPI’s Penetration Testing Services can assist with verifying exposure and validating your patching efforts: NetSPI PTaaS. 

Synack CVE Checks: Synack’s CVE catalog has been updated for crowd verification of exposure and patch validation.

Details

Discovery & Remediation Guidance

• Review and Audit 
  • Identify all Apache HTTP Server installations in your environment: including web servers, reverse proxies, containers, and third-party products or appliances that bundle httpd, and confirm the installed version (e.g., httpd -v or apachectl -v).
  • Determine whether mod_http2 is loaded (apachectl -M | grep http2) and whether HTTP/2 is enabled anywhere in the configuration, including inside every VirtualHost (e.g., grep -rniE “Protocols.*h2c?” /etc/httpd /etc/apache2).
  • For internet-facing hosts, confirm what is negotiated externally (e.g., curl -sI --http2 https://<host>/ | head -1; an “HTTP/2” response indicates h2 is enabled).
  • Prioritize internet-facing Apache HTTP Server instances with HTTP/2 enabled, particularly those acting as reverse proxies in front of sensitive applications.
  • Distribution packages may include the fix while still reporting an older version number; check your vendor’s advisory to confirm patch status.
  • Apache has not published specific IOCs, and the attack uses otherwise normal-looking HTTP/2 traffic. Treat unexpected httpd child process crashes (e.g., segmentation faults in the error log), anomalous HTTP/2 traffic patterns, or unexpected processes spawned by the web server account as potential indicators of exploitation.
  • If an unpatched Apache HTTP Server with HTTP/2 enabled is reachable from the internet and shows such anomalies, treat it as potentially compromised pending update and investigation.

• Patch Immediately 
  • Update to Apache HTTP Server 2.4.71, released by the Apache Software Foundation on November 11, 2026 (see the Apache HTTP Server 2.4 security vulnerabilities page). Source releases are available on the Apache HTTP Server download page.
  • Apply your Linux distribution or vendor security errata where available (e.g., Red Hat for RHEL 9 and 10; Debian security tracker). At the time of this notice, not all distributions have shipped fixed packages; track vendor status closely.
  • No fixed standalone mod_h2 release has been published. If you build mod_h2 from GitHub, replace it with the mod_http2 module bundled with Apache HTTP Server 2.4.71.
  • Restart (not only reload) httpd after updating to ensure all child processes load the patched module.
  • Updating to 2.4.71 also fixes two less severe issues: CVE-2026-106023, a mod_md crash rated Important by Apache, and CVE-2026-109163, a mod_vhost_alias memory bug rated Low.

• Mitigation (If Patching Is Delayed)
  • Disable HTTP/2 by restricting the Protocols directive to HTTP/1.1 (Protocols http/1.1), removing h2 and h2c from the global configuration and from every VirtualHost, then restart httpd.
  • If HTTP/2 is not required at all, stop loading mod_http2 (comment out LoadModule http2_module) and restart httpd.
  • Where HTTP/2 must remain available to clients, consider terminating HTTP/2 at an unaffected load balancer, CDN, or reverse proxy and forwarding to Apache over HTTP/1.1 only.
  • Limit the impact of a successful compromise: run httpd with least privilege, restrict outbound network access from web servers, and avoid mounting unnecessary credentials (e.g., Kubernetes service account tokens) into web server containers.
  • Monitor Apache error logs for repeated child process crashes or segmentation faults, and alert on unexpected processes spawned by the httpd or web server account.
  • If an unpatched internet-facing server shows signs of exploitation, treat the system as compromised – initiate incident response, isolate the host if feasible, and preserve logs before applying the update.

NetSPI Internal Response

NetSPI and Synack systems are not affected by CVE-2026-119618. Continuous review, monitoring, and patch validation remain in place.

Additional Resources

• NVD — CVE-2026-119618
• MITRE — CVE-2026-119618
• Apache HTTP Server — Security Advisory
• GitHub — apache/httpd fix commit (mod_http2)
• Red Hat — CVE-2026-119618
• Public research — memory corruption reproduction
• Apache HTTP Server Downloads