A vulnerability in Apache httpd, exploited for remote code execution via HTTP/2

The release of Apache HTTP Server 2.4.71 has been published, which addresses a vulnerability (CVE-2026-119618) in the mod_http2 module, classified as critical. This vulnerability allows for remote code execution on the server when a specially crafted HTTP/2 request is sent. The vulnerability appears in versions of Apache httpd starting from 2.4.55 and also affects the separate mod_h2 module distributed via GitHub. The status of vulnerability fixes in distributions can be assessed on the following pages: Debian, Ubuntu, SUSE, RHEL, Gentoo, Arch.
Fedora, FreeBSD.

The issue is caused by a race condition when multiple threads call the assign_headers() function simultaneously, resulting from the function processing a shared structure (req->headers) rather than a separate copy for each thread (r->headers_in). If successfully exploited, an attacker could achieve memory modification outside of the allocated buffer. The vulnerability was identified around the same time by researchers from Anthropic and Google. An exploit has not yet been publicly released. As a workaround to block the vulnerability, it is sufficient to disable HTTP/2 connection handling in the httpd.conf configuration file by using the directive 'Protocols http/1.1'.

According to the September report from Netcraft, approximately 170 million sites (11.56%) are running under Apache httpd. It does not specify how many of these use HTTP/2.

Source: opennet.ru