Apache HTTP Server 2.4.71 fixes CVE-2026-119618, a critical flaw in mod_http2 that can lead to remote code execution. Released on November 11, the update addresses vulnerable upstream versions from 2.4.55 through 2.4.70.
Apache describes an improper synchronization issue in the module’s assign_headers() function that can corrupt heap memory. The separately distributed mod_h2 releases 2.0.8 through 2.0.42 are also listed as affected.
Exposure depends on the deployment’s HTTP/2 configuration. Apache’s documentation shows that mod_http2 must be loaded and HTTP/2 enabled through the Protocols directive. Administrators should check both server-wide configuration and individual virtual hosts.
For installations built from Apache’s upstream releases, upgrading to 2.4.71 is the corrective action. For distribution-managed packages, follow the vendor’s CVE-specific update instructions and confirm that the installed package contains the fix.
The Apache advisory does not state whether the vulnerability has been exploited in the wild. Its critical rating and code execution impact make reachable HTTP/2 deployments a priority for patch review.
