Critical Apache HTTP/2 flaw: apply the 2.4.71 patch now

The Apache Software Foundation released version 2.4.71 of Apache HTTP Server on 11 November 2026. The release closes a critical flaw in the HTTP/2 module mod_http2 that can lead to remote code execution without any authentication.

What the flaw is

CVE-2026-119618 is a race condition caused by concurrent access to a shared resource inside mod_http2. It can corrupt heap memory, and that corruption can be turned into code execution. Apache rates the issue "critical"; Red Hat assigned a CVSS score of 9.8 in its own advisory. The Apache project itself did not publish a CVSS vector.

Affected releases run from 2.4.55 through 2.4.70. The standalone mod_h2 package built from GitHub is also affected in versions 2.0.8 to 2.0.42; that repository has been archived and has no patched release.

One detail matters a great deal: only servers with HTTP/2 enabled are in scope. HTTP/2 is turned on by h2 (over TLS) or h2c (over plain TCP) in the Protocols directive. Because that directive can be set globally and inside an individual virtual host, both places need checking.

The same release fixes two more issues: a NULL pointer dereference in mod_md during HTTP request handling that can crash a child process (CVE-2026-106023; 2.4.30–2.4.70), and a one-byte stack overflow in mod_vhost_alias (CVE-2026-109163; 2.4.69 and 2.4.70 only).

Why it matters

Sources disagree on exploitation. Red Hat states that public research has demonstrated a reliable exploit against a default configuration. Security firm Wiz said on the same day that no exploit code was public and no in-the-wild exploitation had been reported. As of 11 November the CVE was not listed in CISA's Known Exploited Vulnerabilities catalog.

That uncertainty is not a reason to postpone patching. When a flaw needs no authentication and targets a service exposed directly to the internet, the gap between patch release and the first attack attempts is usually measured in days.

What this means for small and mid-sized businesses

Apache runs in more places inside a typical SME than most teams expect: shared hosting accounts, cPanel and Plesk servers, internal portals and ERP front ends, the web panel of a camera recording system, reverse proxy layers, and legacy application servers nobody has touched in years. Many of these have not been updated since the day they were installed, and HTTP/2 ships enabled by default in a number of distributions.

Distribution coverage is uneven as well. Updates are out for Red Hat Enterprise Linux 9 and 10, while at the time of writing no patch was listed for Debian bookworm, trixie or forky. "We ran the package update" is therefore not a complete answer on its own.

What Kamer Bilişim recommends

• Identify the version and the HTTP/2 state first. Check the version with httpd -v or apache2 -v, and check HTTP/2 with apachectl -S plus the Protocols lines in your configuration files. Any server between 2.4.55 and 2.4.70 with h2 or h2c enabled is in scope.
• Upgrade to 2.4.71 or to your distribution's patched package. Where an immediate upgrade is not possible, the interim step Wiz suggests is removing h2 and h2c from the Protocols directive and leaving only http/1.1. That is a stopgap, not a substitute for the patch.
• Ask your hosting and software vendors for written confirmation. If you rely on shared hosting, a cloud panel or a prebuilt virtual machine image, get confirmation that the patch was applied and on what date. The server not being yours does not remove your responsibility for the data on it.

If you would like help building a server inventory, planning the patch rollout, or making these checks a routine part of a managed maintenance agreement, reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.

Source: The Hacker News, Apache HTTP Server 2.4.71 release announcement, Red Hat security advisories