Apache fixes a critical HTTP/2 flaw that could let attackers run code
Text
CVE-2026-119618 affects Apache HTTP Server 2.4.55 through 2.4.70. Version 2.4.71 fixes the synchronization flaw.
Serving web requests can become a route to running hostile code. Apache disclosed critical vulnerability CVE-2026-119618 on November 11.
Improper synchronization in its HTTP/2 module can corrupt server memory. HTTP/2 is a protocol browsers and websites use to exchange data.
Versions 2.4.55 through 2.4.70 are affected; 2.4.71 fixes the issue. Apache credits Anthropic OSS Scanner and Google Cloud vulnerability researchers.
Possible remote code execution is not evidence that every Apache site has been breached. Operators should check their HTTP/2 configuration and vendor fixes; visitors cannot patch someone else's server.
Original source published: Apache security email, November 11, 2026, 20:19:30 Beijing time / 7:19:30 AM EST.
Share this article
What do you think of this story?
Anonymous feedback, up to 5 reactions per article.
Anonymous comments
Share your thoughts without signing in.
Discuss the technology and the story. Hate, politics and war, threats, abuse, personal accusations, sexual content, ads, links and personal information are not allowed.
No comments yet. Be the first to share.