TR-103 – Critical Remote Code Execution in Apache HTTP Server `mod_http2` (CVE-2026-119618)

Introduction On 11 November 2026, the Apache Software Foundation disclosed CVE-2026-119618, a critical vulnerability in the Apache HTTP Server HTTP/2 module (mod_http2). A concurrency flaw can cause heap memory corruption and may allow an unauthenticated remote attacker to execute code with the privileges of the Apache web-server process.
The issue affects Apache HTTP Server 2.4.55 through 2.4.70 and was fixed upstream in 2.4.71, released on 11 November 2026. Separately distributed mod_h2 releases 2.0.8 through 2.0.42 are also listed as affected. Organisations using distributor-maintained packages should verify the presence of the security backport rather than rely only on the upstream version number.CIRCL updatesRead More