Google Cloud Vulnerability Research

Stories

Apache patches critical HTTP/2 flaw that can corrupt server memory

Co-discovered the flaw

Apache released HTTP Server 2.4.71 on November 11, 2026, closing a race condition in the module that handles HTTP/2 traffic. The flaw, CVE-2026-119618, lets an unauthenticated request corrupt a server process's memory and potentially run attacker code. Every release from 2.4.55 through 2.4.70 is affected when HTTP/2 is enabled.

Updated 2 hours ago