If you run Apache HTTP Server with HTTP/2 enabled — and that covers a huge share of the public internet — this is a stop-and-patch alert. A critical flaw in the mod_http2 module lets an unauthenticated attacker execute code on your server, and it was disclosed on November 11 as CVE-2026-119618 with a CVSS score of 9.8 out of 10.

This isn’t a background-noise CVE. This is remote code execution in the most widely deployed web server on the planet, and it’s triggered remotely — no credentials, no authentication, no account on the box required. If your server negotiates HTTP/2, someone who can reach it can take it over.

What the vulnerability is

The flaw lives in mod_http2, the Apache module responsible for serving HTTP/2 traffic. It’s a race condition — a concurrency bug that trips when multiple threads touch shared resources at the same time without proper synchronization — in the assign_headers() function.

It was discovered independently by two research teams: Anthropic’s OSS Scanner and Google Cloud’s Vulnerability Research group. During concurrent processing of HTTP/2 streams, a worker thread can modify a header table that belongs to another execution context. That unsafe access to shared memory corrupts the heap. In the hands of an attacker, heap corruption on the server means the ability to execute arbitrary code with the privileges of the httpd web server process.

In plainer terms: a remote attacker sends a crafted sequence of concurrent HTTP/2 requests, trips the race, corrupts memory, and ends up running whatever they want on your server.

Who’s affected

– Apache HTTP Server versions 2.4.55 through 2.4.70
– Standalone mod_h2 versions 2.0.8 through 2.0.42

Two important caveats narrow the blast radius — but don’t use them as an excuse to relax:

1. HTTP/2 must actually be enabled. The vulnerable code path is only reachable if the server negotiates HTTP/2 via the Protocols directive (h2 or h2c). Servers locked to HTTP/1.1 only are not affected. But HTTP/2 is on by default in most modern Apache distributions, so most servers qualify as vulnerable.
2. Just installing or loading mod_http2 isn’t enough. The bug only triggers over active HTTP/2 connections, so if you’ve never enabled it, you’re not exposed — until someone flips it on.

Red Hat indicated the versions are directly affected across RHEL 9, RHEL 10, and JBoss Core Services 1, and patch backports are rolling out.

This is a server-side memory-corruption RCE, not a client-side click handler. No user interaction. No phishing. Just a remote attacker and reachable HTTP/2 port.

Why it matters

Apache HTTP Server is the backbone of the modern web — it’s been the most popular web server for decades and still powers a massive share of internet-facing sites, including a large chunk of shared hosting and open-source infrastructure. A critical, unauthenticated RCE in its most-used protocol path is exactly the kind of bug attacker groups and ransomware operations scan for within hours of disclosure.

The original request handling paths are shared across nearly every site on an affected host. Because the corruption happens in Apache’s memory space, a successful exploit can move laterally into any virtual host or application hanging off that server. If you run Apache, this should be at the top of your priority list.

What to do right now

Apply the update. Upgrade to Apache HTTP Server 2.4.71 or later, or install your vendor’s patched package (watch for the specific security backport in your distribution, not just the version number). Red Hat shipped fixed mod_http2 packages on November 11, the same day Apache released 2.4.71.

If you can’t patch immediately, disable HTTP/2. This is a clean, effective workaround. Edit your httpd configuration — typically /etc/httpd/conf/httpd.conf or a file under /etc/httpd/conf.d/ — and remove h2 and h2c from your Protocols directive, leaving only HTTP/1.1:

Protocols http/1.1

Then restart the service:

systemctl restart httpd

Treat every internet-facing Apache host as a target. Check inventory for all Apache installations, not just your production web servers. Development boxes, internal dashboards, staging environments, API gateways, and reverse proxies all count. Attackers don’t care what the server is for — they care that it’s reachable and unpatched.

Confirm whether you ever enabled HTTP/2. If you’re not sure, grep your configuration for Protocols and check whether h2 or h2c appears. If it does, you’re in scope for this one.

There’s also a reminder embedded in this CVE’s timeline: disclosure on November 11, fix had landed on the 2.4.x branch a few days prior, and Anthropic’s scanner flagged it on October 26. The gap between a flaw being found and you being patched is measured in days. Attackers are already measuring it in hours.

Patch Apache. Do it now.