CVE-2026-119618: Critical Apache HTTP/2 Flaw Allows Remote Code Execution

# CVE-2026-119618: Critical Apache HTTP/2 Flaw Allows Remote Code Execution

https://gcdradar.vercel.app/incidents/cve-2026-119618-critical-apache-http-2-flaw-allows-remote-co · AIR-2026-1919 · live

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Critical vulnerability with a vendor fix available.
- Fix status: Patched
- First reported: 2026-11-12 (happened 2026-11-11)
- AI role: No AI role
- Products: Apache HTTP Server
- CVE ids: CVE-2026-119618
- CVSS: 9.8

## Summary

A critical remote code execution vulnerability affects the mod_http2 module in Apache HTTP Server versions 2.4.55 through 2.4.70. A patch has been released in version 2.4.71 to address the issue.

## What to do

Update Apache HTTP Server to version 2.4.71.

## Affected and fixed versions

- Affected: Apache HTTP Server 2.4.55 to 2.4.70
- Fixed in: Apache HTTP Server 2.4.71

## Latest updates

- 2026-11-12: Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely (https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html)

## Sources

- 2026-11-12 The Hacker News: Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html
- 2026-11-12 SecurityWeek: Apache Patches Critical HTTP Server RCE Found by Anthropic, Google https://securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google
- 2026-11-12 BleepingComputer: Apache HTTP Server patches critical HTTP/2 remote code execution flaw https://bleepingcomputer.com/news/security/apache-http-server-patches-critical-http-2-remote-code-execution-flaw

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.