Apache patches critical HTTP/2 flaw that can corrupt server memory

Overview

Updated 1 hour ago

Apache released HTTP Server 2.4.71 on November 11, 2026, closing a race condition in the module that handles HTTP/2 traffic. The flaw, CVE-2026-119618, lets an unauthenticated request corrupt a server process's memory and potentially run attacker code. Every release from 2.4.55 through 2.4.70 is affected when HTTP/2 is enabled.

The bug sits in one line of assign_headers(). For a body-less request that carries a Content-Type and no Content-Length, the function writes a synthesized Content-Length into a table shared with the connection thread instead of the request's private copy. When that table is full, the write pulls memory from a pool with no lock, and two threads can claim the same block. Apache's advisory says public research demonstrated a reliable exploit; Wiz said no exploit was available and none had been seen in the wild.

Why it matters

Any unpatched server with HTTP/2 enabled carries a remotely reachable memory-corruption bug. Removing h2 and h2c from the Protocols directive blocks it.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

Apache HTTP Server releases affected (2.4.55 through 2.4.70)

The standalone mod_h2 module is affected from 2.0.8 through 2.0.42.

Request headers needed to fill the table and trigger the allocation

79 regular headers plus the Host entry synthesized from :authority.

Days from Anthropic's report to the 2.4.71 release

Anthropic reported on October 26, 2026; Apache shipped the fix on November 11.

2.4.71

First fixed Apache HTTP Server release

Standalone mod_h2 is fixed in version 2.0.43.

Voices

Curated perspectives — historical figures and your fellow readers.

People Involved

Anthony Weems

Security researcher, Google Cloud Vulnerability Research

Credited in Apache's advisory for CVE-2026-119618

Simon Scannell

Security researcher, Google Cloud Vulnerability Research

Credited in Apache's advisory for CVE-2026-119618

Organizations Involved

Apache Software Foundation

Open-source foundation

Maintains Apache HTTP Server; released 2.4.71

The nonprofit behind the Apache HTTP Server, the most widely deployed web server software.

Google Cloud Vulnerability Research

Security research group

Co-discovered the flaw

A security research group inside Google Cloud.

Anthropic

AI company

Its OSS Scanner reported the flaw first

An AI company whose automated scanner found the bug.

Wiz

Cloud security firm

Publicly assessed exploit availability

A cloud security company that tracks vulnerability exploitation.

Timeline

October 2026 November 2026

5 events Latest: 2 days ago

Tap a bar to jump to that date

November 2026
Apache releases 2.4.71 and publishes the advisory
Latest Release

Apache ships HTTP Server 2.4.71 and publishes the CVE-2026-119618 advisory.
2 days ago
Wiz disputes exploit availability
Statement

Wiz says no exploit is available and no in-the-wild exploitation is reported.
2 days ago
Fix merged into Apache httpd
Patch

Apache merges the one-line fix into httpd trunk and the 2.4.x branch.
4 days ago
Google researchers file a second report
Disclosure

Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research report the same flaw.
November 3rd, 2026
October 2026
Anthropic's scanner reports the flaw
Disclosure

Anthropic's OSS Scanner reports the mod_http2 race to Apache's security team as ANT-2026-MAPKT6MZ.
October 26th, 2026

Scenarios

No public exploit appears and mass exploitation never happens

Possible Resolves by May 11, 2027

Discussed by: Wiz

Wiz said on the day of the advisory that no exploit was available and no in-the-wild exploitation had been reported. If that holds, the flaw joins the list of critical-rated bugs that never became a worm, and the story ends with patch adoption.

Public exploit code turns the flaw into mass scanning

Possible Resolves by Feb 11, 2027

Discussed by: Apache's advisory, which says public research demonstrated a reliable exploit

Apache's own assessment says public research showed a reliable exploit against a default configuration with mod_http2 enabled, though it did not name the research. If working code circulates, automated scanners would find unpatched 2.4.x servers within days.

Distributions and downstream vendors ship backported patches

Likely Resolves by Jan 11, 2027

Discussed by: NHS England Digital and University of Michigan security advisories

Linux distributions and hosting providers that ship older 2.4.x builds must backport the one-line fix or disable HTTP/2. Advisories from NHS England Digital and the University of Michigan tell administrators to update.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

April 2014

Heartbleed (2014)

A missing bounds check in OpenSSL's heartbeat extension let anyone read up to 64 kilobytes of a server's memory per request. The bug, CVE-2014-0160, affected a library used by a large share of the internet's secure web servers.

Then

Administrators patched OpenSSL and revoked certificates in a rush; some attackers used the bug to steal private keys.

Now

It became the reference case for memory-safety bugs in open-source infrastructure and pushed funding toward OpenSSL maintenance.

Why this matters now

CVE-2026-119618 is another memory-safety flaw in server software much of the web depends on, and it raises the same question: how fast can a scattered install base patch?

December 2021

Log4Shell (2021)

A logging library used across Java applications, Log4j 2, accepted a lookup string that could load and run remote code. The flaw, CVE-2021-44228, was unauthenticated and trivially exploitable.

Then

Exploit attempts began within hours of disclosure; companies spent weeks inventorying hidden copies of the library.

Now

It set a new benchmark for how quickly a critical open-source bug becomes a mass exploitation event.

Why this matters now

Apache's advisory says public research demonstrated a reliable exploit for CVE-2026-119618, the same condition that preceded Log4Shell's rapid spread.

March-September 2017

Equifax and Apache Struts (2017)

Apache disclosed CVE-2017-5638, a remote code execution flaw in its Struts 2 web framework, in March 2017. Equifax did not patch a public-facing portal, and attackers used the flaw to expose records of about 147 million people.

Then

Equifax's chief executive resigned, and the company later settled with regulators and consumers.

Now

The breach became the standard example of what an unpatched Apache project vulnerability can cost.

Why this matters now

It shows why a one-line fix in an Apache module matters: the gap between disclosure and patching is where the damage happens.