Apache has patched a critical vulnerability in Apache HTTP Server. The bug sits in the HTTP/2 module and can allow an attacker to run their own code on the server.
Apache is patching a bug that affects a large number of web servers worldwide. According to W3Techs, Apache HTTP Server is the web server behind 20.9 percent of websites whose web server is known. Only Cloudflare Server (33.7 percent) and Nginx (30 percent) are more common. The patch is in version 2.4.71, which Apache released on 11 November.
The flaw has been assigned CVE-2026-119618 and rated critical, the highest severity score Apache uses. It was reported by Anthropic’s OSS Scanner and by Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research.
Concurrent requests
HTTP/2 is a version of the protocol that browsers and web servers use to communicate with each other. It allows multiple requests to be handled at the same time over a single connection. That concurrent work is where it goes wrong. Several tasks get access to the same piece of memory, without the module properly controlling who may modify it and when.
Criminals who deliberately trigger this can corrupt the server’s memory. According to Apache, an attacker can use this to remotely execute their own code on the server.
Vulnerable versions
Versions 2.4.55 through 2.4.70 are affected, and only if the HTTP/2 module (mod_http2) is active. The standalone mod_h2 module on GitHub is also vulnerable, in versions 2.0.8 through 2.0.42.
The W3Techs figure of 20.9 percent is therefore an upper limit. Servers running a version older than 2.4.55 or without HTTP/2 are not affected by this flaw. It is not known how many Apache servers meet both conditions.
Administrators running an affected version can update to 2.4.71. That version also fixes two other flaws, one of which Apache rates as important. Apache does not state for any of the three that they are already being exploited. If a quick update is not possible, temporarily disabling the HTTP/2 module is enough.