Apache has patched a crucial HTTP Server vulnerability that would permit unauthenticated distant code execution (RCE), following unbiased discoveries by Anthropic and Google researchers.
Tracked as CVE-2026-119618, the flaw impacts Apache HTTP Server variations 2.4.55 via 2.4.70. The problem was addressed on November 11 with the discharge of model 2.4.71. It resides in mod_http2, the module accountable for dealing with HTTP/2 visitors.
The vulnerability includes a race situation during which a number of threads improperly entry shared assets, probably corrupting server reminiscence.
In accordance with Crimson Hat, an attacker might exploit the difficulty remotely with out authentication to execute arbitrary instructions and achieve management of the server course of. Crimson Hat assigned the vulnerability a CVSS rating of 9.8 and defined that “solely servers which have HTTP/2 enabled are affected; servers configured to serve solely HTTP/1.1 will not be weak.”
Apache credited Anthropic’s OSS Scanner with reporting the flaw on October 26. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Analysis independently reported the identical vulnerability on November 3.
Cloud safety agency Wiz reported that 64% of cloud environments in its knowledge contained assets working affected Apache variations, whereas 51% had publicly uncovered cases. The corporate cautioned that these figures don’t account for server configuration, so they don’t essentially symbolize exploitable installations.
Crimson Hat says public analysis has demonstrated a dependable exploit in opposition to a server with mod_http2 enabled, however its advisory doesn’t establish the analysis.
Wiz famous that when its weblog was printed on November 11, no exploit was out there and there have been no reviews of exploitation within the wild.
A publicly out there proof of idea (PoC) on GitHub reviews reproducing reminiscence corruption and Apache course of crashes, however doesn’t exhibit distant code execution.
Organizations are suggested to put in Apache HTTP Server 2.4.71 or vendor-supplied packages. Disabling HTTP/2 can quickly forestall exploitation if updates can’t be deployed instantly.
Defiant additionally warned that WordPress safety updates can not resolve the difficulty as a result of it impacts the underlying internet server.
Apache HTTP Server 2.4.71 additionally fixes two different vulnerabilities: CVE-2026-106023, an essential problem that may crash server processes, and CVE-2026-109163, a low-severity stack buffer overflow.
Associated: Hackers Goal N-central Zero-Days as N-able Rushes Patches
Associated: Attacker Targets 60,000 GitHub Repositories in Credential Theft Marketing campaign
Associated: Essential Crimson Hat Quay Vulnerability May Expose Personal Container Photos
