Overview
- Apache published version 2.4.71 on November 11 to fix CVE-2026-119618 after independent reports from Anthropic and Google Cloud.
- The bug is a race condition in mod_http2’s assign_headers() that can produce heap corruption and could be leveraged for pre-auth remote code execution by sending crafted HTTP/2 requests.
- Only Apache HTTP Server 2.4.55 through 2.4.70 and standalone mod_h2 builds 2.0.8 through 2.0.42 are affected and only when HTTP/2 is enabled via the Protocols directive (h2 or h2c).
- Administrators should install 2.4.71 or vendor-supplied fixes, rebuild container images made before the patch, or temporarily disable HTTP/2 (remove h2 and h2c) if they cannot patch immediately.
- A GitHub proof-of-concept reproduces memory corruption and crashes but does not demonstrate confirmed remote code execution; vendors disagree about a publicly reliable exploit and there are no confirmed reports of in-the-wild compromise, while Wiz reports large cloud exposure numbers that do not account for configuration.