A critical remote code execution flaw, CVE-2026-119618, affects Apache HTTP Server versions 2.4.55 through 2.4.70 — but only if your server has HTTP/2 enabled. The fix is Apache 2.4.71, released on November 11, 2026. If you run a website on Apache, check your version today: the check takes less than a minute, and patching now is far safer than waiting to see whether attackers start exploiting it.
This guide explains what the vulnerability is, how to tell whether your server is affected, and the exact steps to fix it. It also covers what to do if you cannot patch immediately, and how to check your server afterwards. You do not need deep server knowledge — if you can run one command or ask your hosting provider a question, you can do this.
What Is CVE-2026-119618?
CVE-2026-119618 is a race condition in Apache's HTTP/2 module, mod_http2, in a function called assign_headers(). A race condition happens when two parts of a program use the same piece of memory at the same time without proper synchronization. Here, the flaw can corrupt heap memory, and that corruption can let a remote attacker who needs no login at all run their own code on the server.
Security researchers classify this flaw as CWE-362, which describes concurrent execution using a shared resource with improper synchronization. In plain terms, the server's HTTP/2 handling can be tricked into a timing window where memory is used unsafely. Apache rates the vulnerability critical, and Red Hat assigns it a CVSS 3.1 score of 9.8 out of 10 — the highest severity band — because it is exploitable over the network, needs no privileges, and needs no user interaction.
The flaw was discovered independently by two teams. Anthropic's open-source scanner reported it on October 26, 2026, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported it on November 3, 2026. Apache released the fix — version 2.4.71 — on November 11, 2026, the same day the vulnerability was publicly disclosed. The National Vulnerability Database had not published its own score for the flaw as of November 12.
Am I Affected? Check Two Things
Two conditions must both be true for your server to be at risk. First, it must run an affected version: Apache HTTP Server 2.4.55 through 2.4.70, or a standalone mod_h2 build from 2.0.8 through 2.0.42. Second, HTTP/2 must be enabled on the server. If either condition is false — you run an older or patched version, or your server only serves HTTP/1.1 — this vulnerability does not affect you.
That second condition is the good news for many site owners. Plenty of Apache servers still serve HTTP/1.1 only, either because HTTP/2 was never enabled or because their setup does not support it. Those servers are not affected by this flaw, and they need no emergency action. The servers that do need urgent attention are the ones with HTTP/2 switched on — which is common on modern hosting, because HTTP/2 makes pages load faster.
| Setup | Affected versions | What to do |
|---|---|---|
| Apache HTTP Server | 2.4.55 – 2.4.70 | Upgrade to 2.4.71 or later |
| Standalone mod_h2 | 2.0.8 – 2.0.42 | Update with Apache 2.4.71 |
| HTTP/1.1 only | Not affected | No action needed for this flaw |
| Apache 2.4.71 or later | Not affected | Already fixed — verify the version |
How to Check Your Apache Version
If you have shell access to your server, checking takes seconds. Run one of these commands — apachectl -v on most systems, or httpd -v on Red Hat-based systems — and the output shows your version number. Compare it with the table above: anything from 2.4.55 to 2.4.70 needs the patch, and anything older than 2.4.55 or at 2.4.71 and above is not vulnerable to this flaw.
apachectl -v
httpd -vIf you do not have shell access — for example, on shared hosting — you have two options. First, ask your hosting provider: send them a message asking which Apache version your site runs and whether HTTP/2 is enabled. Second, check your server's response headers with a free tool. FrostRank's HTTP Header Checker shows the headers your server sends back, which often reveal the server software and version.
How to Check Whether HTTP/2 Is Enabled
On a server you manage, look for the Protocols directive in your Apache configuration. If it lists h2 — for example, Protocols h2 http/1.1 — then HTTP/2 is enabled and your server is in scope if the version is affected. If the directive is missing or lists only http/1.1, HTTP/2 is off and this flaw does not apply to you.
Protocols h2 http/1.1You can also check from the outside. Open your site in a browser, open the developer tools, and look at the protocol column in the network tab — it shows h2 when a page loads over HTTP/2. A header-checking tool can show the same information: the response headers reveal which protocol served the page and which server software answered. Either method tells you whether HTTP/2 is live without touching the server configuration.
How to Patch: Upgrade to Apache 2.4.71
The fix is straightforward: upgrade to Apache HTTP Server 2.4.71 or later. On a server you manage with a package manager, update the Apache package, confirm the new version, and restart the service so the new code actually runs. The exact commands depend on your distribution — Debian and Ubuntu use apt, Red Hat and AlmaLinux use dnf or yum — but the pattern is the same everywhere: update, verify, restart.
sudo apt update && sudo apt upgrade apache2
sudo systemctl restart apache2
apachectl -vBefore you upgrade, take a quick backup of your Apache configuration and your site — a copy of the config files and a snapshot of your site data is enough. Upgrades rarely break anything, but a backup means you can roll back in minutes if something unexpected happens. It is the same habit that protects you during any server change, not just this one.
After restarting, verify the fix. Run apachectl -v again and confirm it reports 2.4.71 or later. Then check that your site still loads normally — a quick visit to your homepage and one or two key pages is enough. If your hosting provider manages Apache for you, the patch may already be applied or scheduled: ask them for the version and the date they expect it live, and check again after that date.
One caution: do not delay the upgrade to test every detail first. The vulnerability is rated critical and the fix is a stable point release from Apache, announced in the official 2.4.71 release announcement. Apply the patch in your normal maintenance window — but make that window today or tomorrow, not next month. The longer an affected server stays unpatched, the larger the window for an attacker to try.
If You Cannot Patch Right Now: Disable HTTP/2
Sometimes patching immediately is not possible — a change freeze, a dependency on an older package, or a hosting provider that has not shipped the update yet. In that case, the effective stopgap is to disable HTTP/2. Edit your Apache configuration so the Protocols directive serves HTTP/1.1 only, then restart Apache. With HTTP/2 off, the vulnerable code never runs, so the flaw cannot be reached.
Protocols http/1.1There is a trade-off, and you should know it before you switch. HTTP/2 makes pages load faster — it multiplexes requests over a single connection, so modern sites feel noticeably quicker with it on. Turning it off may slow your site down, especially on pages with many images, scripts, or stylesheets. That is a real cost, but it is temporary: re-enable HTTP/2 as soon as the patch is applied.
If you use shared hosting and cannot change the configuration yourself, ask your provider to disable HTTP/2 on your account until the patch lands — or ask when the patch will be applied. A hosting provider that cannot answer either question is a reason to reconsider where your site lives. Security patches are part of what hosting is for.
What an Attacker Could Do With This Flaw
Remote code execution means the attacker runs their own code on your server, with the same privileges as the Apache process. From there, they could read files on the server, steal data from your website or database, deface pages, or install software that uses your server to attack other machines. They could also plant a backdoor — code that lets them return later, even after you patch, unless you also check for it.
That is why patching is only the first step if you suspect your server was already targeted. After upgrading, check your logs for unusual requests around the disclosure date, and look for unexpected files or processes. If anything looks wrong, treat it as a possible compromise: restore from a known-clean backup and change your credentials. If your logs look clean and you patch promptly, you are most likely fine.
Best Free Website Security Tools to Check Your Server
Patching is the fix, but checking is how you know the fix worked — and how you catch the next problem early. The best website security tools for this job are the free ones that show you what your server actually sends back. A header checker reveals your server software, your protocol, and your security headers in one view. Use it before patching to confirm you are affected, and again afterwards to confirm the new version is live.
FrostRank's free HTTP Header Checker is one such tool: paste your URL and it shows the response headers your server sends, including the server software and version when the server discloses them. Pair it with a look at your security headers — the response headers that tell browsers how to handle your site — and you get a quick picture of your server's public posture. Our security headers post explains which headers matter and what to set.
No single free scanner covers everything, though. A header check shows what your server reveals, but it cannot see your installed packages or your configuration files — only you or your host can check those. The honest approach is to combine tools: a website security scanner for the outside view, your package manager or your host's dashboard for the version, and the Apache security advisories page for the authoritative list of fixed versions.
Why Patch Now Instead of Waiting
It is tempting to wait for proof that attackers are exploiting a flaw before patching. That is the wrong call here. Wiz reported no exploit available and no exploitation in the wild as of its November 11 publication — but Red Hat notes that public research demonstrated a reliable exploit against a default-configured server with mod_http2 enabled. In other words, the exploit path is understood, and waiting for an in-the-wild report means waiting until it is too late.
The scale of exposure is also large. According to Wiz's write-up of the vulnerability, 64% of cloud environments have resources vulnerable to this flaw, and 51% have publicly exposed instances — figures drawn from Wiz customer data, so they describe Wiz's customers rather than every server on the internet.
Even so, the pattern is clear: this is not a rare edge case. Many Apache servers run affected versions with HTTP/2 on, and many of them face the public internet.
The fix takes minutes and the risk of delay is real. A remote, unauthenticated attacker who can run code on your server can steal data, deface your site, or use the server to attack others — and you would be the one explaining it afterwards. Patching now, or disabling HTTP/2 until you can, closes that door before anyone walks through it.
Frequently Asked Questions
Am I affected by CVE-2026-119618?
You are affected only if two things are both true: your server runs Apache HTTP Server 2.4.55 through 2.4.70 (or standalone mod_h2 2.0.8 through 2.0.42), and HTTP/2 is enabled. Check your version with apachectl -v and look for the Protocols directive in your configuration. If you run HTTP/1.1 only, or you are already on 2.4.71 or later, this flaw does not affect you.
How do I check my Apache version?
Run apachectl -v on most systems, or httpd -v on Red Hat-based systems. The output shows your version number. If you do not have shell access, ask your hosting provider, or check your server's response headers with a free header-checking tool. Anything from 2.4.55 to 2.4.70 with HTTP/2 enabled needs the 2.4.71 patch.
What is the best free website security scanner?
There is no single best website security scanner, because no one tool sees everything. A free header checker shows your server's public response — software, version, and security headers — but it cannot see your installed packages. Combine an outside check with your package manager or hosting dashboard for the version, and the Apache security advisories for the authoritative fix list.
Is there an exploit in the wild for CVE-2026-119618?
As of Wiz's November 11 publication, no exploit was available and no exploitation in the wild had been reported. However, Red Hat notes that public research demonstrated a reliable exploit against a default-configured server with mod_http2 enabled. Do not wait for an in-the-wild report — patch to 2.4.71 now, or disable HTTP/2 until you can.
What if my host has not patched yet?
Ask your hosting provider when the 2.4.71 update will be applied to your server, and whether they can disable HTTP/2 on your account in the meantime. If they cannot answer, or they have no patch timeline, consider moving to a host that treats security updates as urgent. Managed hosts usually patch quickly — the ones that do not are telling you something.
Does disabling HTTP/2 hurt my site?
It can slow page loads, because HTTP/2 multiplexes requests over a single connection and HTTP/1.1 does not. The effect is most noticeable on pages with many images, scripts, or stylesheets. Treat it as a temporary stopgap: disable HTTP/2 only until the 2.4.71 patch is applied, then turn it back on and keep the speed.
CVE-2026-119618 is a serious flaw, but it is also a fixable one. The check takes a minute, the patch takes a few more, and the stopgap is one configuration line if you need it. Run apachectl -v today, confirm whether HTTP/2 is on, and get to 2.4.71. Your server — and everyone who visits your site — will be safer for it.
