A critical vulnerability has been identified in the Apache HTTP Server's HTTP/2 module, mod_http2, which allows remote attackers to execute code on affected servers. The flaw, tracked as CVE-2026-119618, affects versions 2.4.55 through 2.4.70.
The vulnerability was reported by Anthropic's OSS Scanner on October 26, 2026, and independently by Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research on November 3, 2026. A fix was released in version 2.4.71 on November 11, 2026.
Red Hat has rated the flaw with a CVSS score of 9.8, indicating its critical nature. The issue can be exploited without authentication if the attacker can reach the server. Public research has demonstrated a reliable exploit against servers with mod_http2 enabled.
Wiz reported that 64% of cloud environments contained resources running affected Apache versions. However, as of November 11, 2026, there were no reports of exploitation in the wild, and no exploit was available.
Red Hat shipped fixes for Red Hat Enterprise Linux 9 and 10 on the same day the Apache fix was released. However, the standalone mod_h2 project has not yet published a fixed release for the vulnerability.