CVE-2026-119618 is a critical race condition in Apache HTTP Server’s HTTP/2 implementation that can corrupt heap memory and enable remote code execution. The vulnerability affects Apache HTTP Server versions 2.4.55 through 2.4.70 and standalone mod_h2 releases 2.0.8 through 2.0.42. Apache released a fix in version 2.4.71 on November 11. Only servers with HTTP/2 enabled are exposed. Red Hat assigns a CVSS 3.1 score of 9.8, and Bitsight gives a DVE score of 8.23/10.
What happened
Apache disclosed CVE-2026-119618 on November 11 and published Apache HTTP Server 2.4.71 as the fixed release. Anthropic’s OSS Scanner reported the issue to Apache on October 26. Red Hat states public research has demonstrated a reliable exploit against a default-configured server with mod_http2 enabled. Third-party reporting indicates a public GitHub repository contains crash-reproduction tooling, but that repository has not been verified as a working remote-code-execution exploit.
CVE-2026-119618: How it works
The flaw is a thread-safety bug in mod_http2’s assign_headers() function. Apache’s HTTP/2 processing runs requests concurrently across multiple threads, and Red Hat explains that a worker thread can write to memory owned by the connection thread through a shared, lock-free allocator. That race can corrupt the server heap and potentially allow an attacker to execute commands with the privileges of the Apache process. No authentication is required, but the attacker must be able to reach a vulnerable server using HTTP/2. Servers configured to serve only HTTP/1.1 are not affected.
Severity, exposure and distribution notes
Apache rates the issue Critical. Red Hat assigns a CVSS 3.1 score of 9.8, describing a network attack vector, low complexity, no privileges required, and no user interaction. Bitsight assigns a DVE score of 8.23/10. For RHEL 9 and RHEL 10, Red Hat rates the issue Important rather than Critical because those packages use a separate allocator for each HTTP/2 stream, which substantially increases exploitation complexity. Red Hat says RHEL 8 and earlier are not affected. Administrators should check their distribution advisories and package status rather than relying solely on upstream Apache version numbers.
Mitigation and patching
Upgrade affected servers to Apache HTTP Server 2.4.71 or to a vendor package that includes the fix, and restart Apache so the patched code is running. If you use a standalone mod_h2 build, follow maintainer or vendor guidance for a fixed package. If you cannot patch immediately, temporarily disable HTTP/2 and serve HTTP/1.1 only: check both global configuration and virtual-host-specific directives, then restart Apache and confirm HTTP/2 is no longer offered. This is a temporary mitigation; apply the vendor fix as soon as it is available for your environment. Network segmentation and access controls can reduce which systems can reach the web server but do not fix the underlying flaw. Prioritize patching internet-facing instances and internal servers that accept HTTP/2 from untrusted or lower-trust networks.
How Bitsight can help
Bitsight External Attack Surface Management helps identify internet-facing web infrastructure and assess exposure across environments and vendor ecosystems. Bitsight’s Dynamic Vulnerability Exploit (DVE) predicts the likelihood of active threat actor targeting for a vulnerability within a 90 day period. Bitsight Beacon is a supply chain exposure management tool that can help bridge the gap between threat intelligence and third-party risk.
CVE-2026-119618 is a critical race condition in Apache’s HTTP/2 module that can lead to remote code execution. Apache fixed the issue in version 2.4.71, and only servers with HTTP/2 enabled are affected. Red Hat reports that public research has demonstrated a reliable exploit. Teams should patch promptly and temporarily disable HTTP/2 on systems that cannot be updated immediately.
