A critical vulnerability in Apache’s HTTP Server has been patched after being independently discovered by researchers from Anthropic and Google. The flaw, tracked as CVE-2026-119618, could have allowed an attacker to execute arbitrary code on a server without authentication, potentially leading to full control of the system.
The issue affects Apache HTTP Server versions 2.4.55 through 2.4.70, which are widely used in web servers around the world. The vulnerability resides in mod_http2, the module responsible for handling HTTP/2 traffic. A race condition in multiple threads accessing shared resources can lead to memory corruption and potentially allow an attacker to execute arbitrary code.
Red Hat has assigned a CVSS score of 9.8 to this vulnerability, indicating its severity. According to Red Hat’s advisory, only servers that have HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable. This means that organizations using Apache HTTP Server need to assess whether they have mod_http2 enabled and take action accordingly.
Apache has credited Anthropic’s OSS Scanner with reporting the flaw on October 26, while Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research independently reported the same vulnerability on November 3. Cloud security firm Wiz notes that a significant number of cloud environments contain resources running affected Apache versions, with 64% of its dataset showing affected instances and 51% having publicly exposed instances.
Organizations are advised to install Apache HTTP Server 2.4.71 or vendor-supplied packages as soon as possible. Disabling HTTP/2 can temporarily prevent exploitation if updates cannot be deployed immediately. It’s also worth noting that disabling HTTP/2 may not be a feasible solution for all organizations, and the patch should be applied at the earliest opportunity.
It’s essential to remember that this vulnerability affects the underlying web server, which means that security updates from content management systems like WordPress will not resolve the issue. As a result, administrators need to take proactive steps to address this vulnerability before it can be exploited by attackers.
To mitigate this risk, organizations should:
* Verify whether mod_http2 is enabled on their Apache HTTP Server
* Assess whether they have publicly exposed instances
* Install Apache HTTP Server 2.4.71 or vendor-supplied packages as soon as possible
* Consider disabling HTTP/2 temporarily if updates cannot be deployed immediately
By taking these steps, organizations can reduce the risk of exploitation and prevent potential attacks on their systems.
Source: SecurityWeek — 2026-11-12