Apache patches critical HTTP/2 remote code execution flaw in HTTP Server

In brief: The Apache Software Foundation has patched a critical Apache HTTP Server flaw in mod_http2, tracked as CVE-2026-119618, which lets unauthenticated attackers run arbitrary commands. Wiz found vulnerable resources in 64% of cloud environments, with roughly half publicly exposed, though servers remain vulnerable only if administrators explicitly enable the HTTP/2 protocol.

Researchers Anthony Weems and Simon Scannell of Google Cloud's Vulnerability Research team discovered the critical Apache HTTP Server flaw, which enables remote code execution (RCE). The pair reported the bug, which affects server versions 2.4.55 through 2.4.70 and standalone mod_h2 versions 2.0.8 through 2.0.42.

How the mod_http2 flaw works

Tracked as CVE-2026-119618, the bug stems from a race condition and thread-safety flaw in the mod_http2 module that corrupts internal heap memory. HTTP/2 allows a client to send many concurrent requests over a single connection, and the module processes those requests across multiple threads. During concurrent request handling, a worker thread writes into memory owned by the connection thread through a shared, lock-free allocator, allowing one thread to alter memory belonging to another.

Apache said the improper synchronisation in mod_http2 within the assign_headers() function "can lead to RCE" on affected hosts. Wiz researchers said that "an attacker can trigger heap corruption" when concurrent threads share resources without proper synchronisation. That memory corruption lets an unauthenticated attacker execute arbitrary commands with the privileges of the web server process. The latest server update also patches two other flaws: CVE-2026-106023, a null pointer dereference in mod_md, and CVE-2026-109163, a low-severity data overwrite issue in mod_vhost_alias.

Red Hat classified CVE-2026-119618 under weakness CWE-20 for improper input validation, tracked in Bugzilla 2567318, and assigned Common Vulnerability Scoring System (CVSS) vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. According to Red Hat's technical impact assessment, an attacker could supply unexpected values to trigger a denial of service (DoS) through crashes or excessive CPU and memory consumption. Attackers who control resource references could also read confidential memory, files, or directories, or modify memory to alter control flow and compromise system confidentiality, integrity, and availability.

Cloud exposure and Red Hat impact

Apache HTTP Server is free, open-source software that handles browser requests and serves web pages, images, and other content for roughly one out of five websites. Wiz telemetry shows vulnerable resources in 64% of cloud environments and publicly exposed instances in roughly half of them, but those totals do not reflect server configuration. The software disables HTTP/2 by default, so a server is vulnerable only when administrators enable h2 or h2c through the Protocols directive, leaving servers configured solely for HTTP/1.1 unaffected.

The web server, known as httpd, is the standard server across Red Hat Enterprise Linux (RHEL) and other Red Hat products. As the authoritative CVE Naming Authority (CNA) for its software, Red Hat said that CVSS ratings vary by vendor build chain and version. Because the mod_http2 packages in RHEL 9 and RHEL 10 allocate each HTTP/2 stream from a separate allocator rather than sharing one with the connection, exploitation is substantially more complex. Red Hat therefore rates the issue as Important rather than Critical on RHEL 9 and RHEL 10, while versions of mod_http2 prior to 2.0.8 lack the affected code and leave RHEL 8 and earlier releases unaffected.

What happens next

Red Hat's Product Security team reported that public research has already demonstrated a reliable exploit against a default-configured server with mod_http2 enabled. Wiz said it is not yet aware of active attacks or public exploits targeting the vulnerability in the wild, though that situation could change soon. Researchers at cybersecurity company watchTowr confirmed the configuration requirement and said technicians should "patch now or drop h2 until you can."

Many vulnerable servers remain reachable over the public internet despite the patch from the Apache Software Foundation. Red Hat advises customers to upgrade to a supported version that includes a fix or apply an available mitigation. Customers who subscribe to the RHEL Security Select Add-on can also review CVE-2026-119618 directly with their Technical Account Manager (TAM).

Read more: Cisco rates Unified CM SSRF flaw critical over root takeover risk · Proof-of-concept exploit released for Android ‘SMS of Death’ flaw · WordPress Core flaw draws nearly 63,000 attack attempts in 24 hours

Sources: BleepingComputer, thehackernews.com, Red Hat Customer Portal, SecurityWeek

Fact-checked against the linked sources before publication. Spotted an error? See our Corrections Policy.

Spotted an error? Email corrections@itmagazineme.com with the article link.