CVE-2026-119618 (CVSS 9.8): Apache HTTP Server mod_http2 Race Condition — Critical RCE Requires Immediate Patching

Apache HTTP Server quietly powers somewhere between 30 and 40 percent of all websites on the internet. On 11 November 2026, the Apache Software Foundation pushed version 2.4.71 — a release that patches CVE-2026-119618, a critical unauthenticated remote-code-execution flaw in the mod_http2 module. With a Red Hat CVSS v3.1 base score of 9.8, this is not a theoretical risk: an attacker on the internet, with no credentials whatsoever, can send crafted HTTP/2 requests at your web server and walk away with a shell. If your stack runs any Apache release from 2.4.55 to 2.4.70 with HTTP/2 enabled, you are exposed right now.

What Is CVE-2026-119618 and Why Does It Matter?

HTTP/2 brought multiplexing, header compression, and faster page loads to Apache. Under the hood, the mod_http2 module manages this complexity through a header-assignment routine called assign_headers(), located in modules/http2/h2_request.c. CVE-2026-119618 is a classic race condition: two concurrent HTTP/2 streams can reach that function simultaneously, clobbering each other’s heap allocations and leaving memory in an inconsistent state. Under the right conditions — which an attacker can engineer deliberately — that heap corruption becomes a vehicle for arbitrary code execution on the server process, running as the Apache user.

The attack requires no credentials. The attack requires no prior access. Any client on the public internet capable of opening an HTTP/2 connection is a potential attacker. That is why the CVSS vector — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — produces a near-maximum score of 9.8.

The flaw was discovered independently by Anthropic’s OSS (Open-Source Security) Scanner, an AI-assisted vulnerability research tool, and by Google Cloud Vulnerability Research. Its attribution to two AI-assisted research programmes is itself a notable milestone: it signals that automated vulnerability discovery is now capable of surfacing concurrency bugs — historically among the hardest class of flaws to find through static or dynamic analysis alone.

Technical Deep Dive: The Race Condition in mod_http2

To understand the risk, it helps to understand what HTTP/2 multiplexing does at the server level. A single TCP connection can carry many concurrent streams; each stream represents an independent HTTP request-response pair. Apache’s mod_http2 processes incoming HEADERS frames for each stream, calling assign_headers() to map the request headers into an internal data structure. The race occurs when two streams simultaneously trigger assign_headers() and compete for the same heap region.

Attribute	Detail
CVE ID	CVE-2026-119618
CWE	CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)
CVSS v3.1	9.8 Critical (Red Hat)
Affected module	mod_http2 (also known as mod_h2)
Vulnerable file	modules/http2/h2_request.c — assign_headers()
Affected httpd versions	2.4.55 – 2.4.70
Affected standalone mod_h2	2.0.8 – 2.0.42
Fixed in	Apache HTTP Server 2.4.71 (released 11 November 2026)
Prerequisite	HTTP/2 enabled (Protocols h2 or h2c)

Red Hat has noted that RHEL 9 and RHEL 10 builds of httpd allocate each HTTP/2 stream from a separate pool allocator. This architectural difference substantially increases exploitation complexity on those platforms, which is why Red Hat rates the severity Important rather than Critical — though patching is still mandatory.

Exposure: Who Is at Risk?

HTTP/2 has been enabled by default in many Linux distributions’ Apache packages since 2022. If your team installed Apache from the standard Ubuntu, Debian, Rocky Linux, or AlmaLinux repositories and never explicitly removed the h2 protocol directive, there is a high probability that HTTP/2 is active on your servers.

The practical exposure test is straightforward:

# Check httpd version
apache2 -v          # Debian/Ubuntu
httpd -v            # RHEL/CentOS/Rocky

# Check if HTTP/2 is enabled
grep -r "Protocols" /etc/apache2/ /etc/httpd/   # Look for "h2" in output
apachectl -M | grep http2                        # Should return blank if mod_http2 not loaded

If your version falls between 2.4.55 and 2.4.70 and you see h2 or h2c in a Protocols directive, you are vulnerable and should act immediately.

The scale of exposure is significant. Apache HTTP Server remains the most widely deployed web server in the world. Even a conservative estimate — say, a third of internet-facing Apache installs running HTTP/2-capable versions — represents tens of millions of servers. India’s large hosting industry, e-commerce platforms, government web portals, and enterprise intranet servers are all within scope if they run the affected range.

What You Should Do Right Now

This is Sanjay Seth’s recommended action sequence for security and IT teams:

1. Upgrade to Apache HTTP Server 2.4.71 (Priority: Critical)

Download directly from httpd.apache.org or wait for your distribution’s official package update — but do not wait passively. Many distributions were shipping updated packages within 24 to 48 hours of the advisory. Check your package manager now:

apt update && apt upgrade apache2        # Debian/Ubuntu
dnf update httpd                         # RHEL/Rocky/AlmaLinux

Note: RHEL-family distros may not bump the version number to 2.4.71 — check the changelog or rpm query for the CVE fix:

rpm -q --changelog httpd | grep CVE-2026-119618

2. Disable mod_http2 as an Immediate Stopgap

If patching must wait — perhaps you are in the middle of a change-freeze window — disable HTTP/2 immediately. This eliminates the attack surface entirely since the vulnerable code path is not reachable:

a2dismod http2            # Debian/Ubuntu
# Edit /etc/httpd/conf.d/http2.conf and comment out LoadModule
# Remove "h2" from all Protocols directives in VirtualHost blocks
apachectl graceful

3. Audit Your Attack Surface with a Web Application Firewall

If you operate a FortiGate or FortiWeb in front of Apache, deploy an IPS signature for CVE-2026-119618 to give yourself an additional detection layer while patching rolls out across your server fleet. Fortinet has published updated IPS definitions — apply them to all relevant policies.

4. Inventory and Patch Management

This is exactly the scenario where a comprehensive asset inventory pays dividends. If you do not know which of your servers run Apache 2.4.55+ with HTTP/2, now is the time to build that list. A similar critical web-stack RCE earlier this year showed how quickly threat actors weaponise unpatched servers — from advisory to active exploitation campaigns was measured in days, not weeks.

5. Monitor for Post-Exploitation Indicators

If exploitation precedes your patch, indicators to look for in Apache access logs include: anomalously high volumes of HTTP/2 HEADERS frames from a single source IP, rapid connection teardowns and reconnections, and unexpected process spawning from the Apache worker process. Consider shipping your Apache logs to your SIEM now if you are not already doing so, and set an alert for new child processes spawned by httpd.

See also: November 2026’s record Patch Tuesday for a broader picture of the current vulnerability landscape and how to triage competing patch priorities.

The AI-Discovery Angle: What It Means for Defenders

The discovery of CVE-2026-119618 by Anthropic’s OSS Scanner and Google Cloud Vulnerability Research marks a meaningful inflection point. Race conditions have traditionally been extremely difficult to detect at scale: they are timing-dependent, non-deterministic, and often invisible to conventional static-analysis tools. AI-assisted fuzzing and symbolic execution are changing that calculus — and not just for defenders. The same techniques that found this flaw can be wielded by threat actors to discover similar concurrency bugs in other server software. The window between discovery and weaponisation will shrink as AI-assisted vulnerability research becomes commoditised.

For Indian enterprises — many of which still rely on 18-to-24 month patch cycles for production servers — this is an urgent reason to accelerate towards a risk-based, continuous patching posture. Waiting for the next scheduled maintenance window is no longer an acceptable default for CVSS 9.8 flaws in internet-facing software.

Frequently Asked Questions

Does this affect Nginx or IIS web servers?

No. CVE-2026-119618 is specific to Apache HTTP Server’s mod_http2 module. Nginx, IIS, and other web servers implement HTTP/2 in different codebases and are not affected by this particular vulnerability. If you run Nginx or IIS, you are not at risk from this CVE — but you should still review those servers’ own patching status separately.

Is HTTP/2 enabled by default on my Apache installation?

It depends on your distribution and configuration. Many modern Linux distributions load mod_http2 by default, but HTTP/2 is only activated when the Protocols directive explicitly includes h2 or h2c. Run apachectl -M | grep http2 and grep -r "Protocols" /etc/apache2/ to verify your actual exposure. If neither shows HTTP/2 enabled, you are not vulnerable — but verify rather than assume.

Are shared hosting environments (cPanel, Plesk) at risk?

Yes, if the hosting control panel’s Apache version falls in the 2.4.55–2.4.70 range and HTTP/2 is enabled. Shared hosting providers typically manage Apache upgrades centrally — but as a site owner or hosting reseller you should confirm with your provider that they have deployed 2.4.71 or applied the equivalent patch. Some providers may move quickly; others may lag. Push your provider for confirmation in writing.

What if I cannot patch immediately due to application compatibility concerns?

The safest immediate mitigation is to disable mod_http2 entirely and revert to HTTP/1.1. Performance will degrade slightly for clients that support HTTP/2, but the security risk is eliminated. This is a temporary measure: test the upgrade to 2.4.71 in a staging environment and deploy to production as quickly as possible. Apache publishes no alternative workaround — there is no configuration knob that mitigates the race condition short of disabling the module.

---

Bottom line: CVE-2026-119618 is a textbook example of why internet-facing servers demand continuous patching discipline rather than scheduled maintenance windows. A CVSS 9.8 unauthenticated RCE in a module enabled by default on tens of millions of servers is exactly the class of vulnerability threat actors prioritise. Upgrade to Apache 2.4.71 today. Disable mod_http2 as a stopgap if you cannot. And audit every Apache instance in your environment — not just the ones you know about.

Need help auditing your web-server fleet, reviewing your patching posture, or deploying FortiWeb/FortiGate WAF rules for this CVE? Contact Sanjay Seth for a security assessment — thirty years of field experience in Delhi NCR, available to your team now.