Apache HTTP Server CVE-2026-119618: Critical HTTP/2 Flaw Fixed in Version 2.4.71

The Apache Software Foundation released Apache HTTP Server version 2.4.71 on 11 November 2026 to fix a critical flaw, CVE-2026-119618, in mod_http2, the module that handles the newer HTTP/2 version of the web protocol. Apache describes it as a race condition (two parts of the server touching the same memory at the same time) in the code that assembles response headers, which can corrupt memory and lead to remote code execution, meaning an attacker could run their own commands on the server. Red Hat rates it 9.8 out of 10 and says an attacker who can reach the server needs no login. The flaw affects Apache HTTP Server 2.4.55 through 2.4.70, and the standalone mod_h2 module from 2.0.8 through 2.0.42, but only where HTTP/2 is turned on. Servers that only speak the older HTTP/1.1 are not affected.

The same release fixes two smaller issues: CVE-2026-106023, rated important, which can crash server processes through the mod_md certificate module, and CVE-2026-109163, rated low, in mod_vhost_alias. As of 11 November, the cloud security company Wiz reported no public exploit and no exploitation in the wild, while Red Hat noted that public research had shown a reliable exploit was possible. England's National Health Service (NHS) cyber team issued an alert on 12 November asking organizations to patch.

Why this matters on the plant floor

Apache HTTP Server is one of the most common web servers in the world, and it is often hidden inside products rather than installed by your own IT team. In industrial sites it can sit behind historian and reporting portals, the web pages of manufacturing execution and energy management systems, Linux-based gateways and remote access appliances, network management tools, and the web interfaces of some vendor appliances in the demilitarized zone (DMZ) between business and control networks. Many of those products run Apache with PHP, the same pairing affected by the PHP2Shell flaws we covered in October. Upgrading is easy on a server you manage yourself, but inside a vendor appliance you have to wait for the vendor's update. Debian's stable releases had no fixed package when this advisory was written, and Red Hat Enterprise Linux 9 and 10 have fixes, while version 8 and earlier do not contain the vulnerable code.

What owners should do now

1. Build a list of every system that runs Apache HTTP Server, starting with anything reachable from the internet or the business network, such as remote access portals, historian web pages and DMZ servers. Ask your control system vendors and integrators directly whether their products include Apache 2.4.55 through 2.4.70.
2. On servers you manage, upgrade to Apache HTTP Server 2.4.71 or to your Linux distribution's fixed package, and restart the service. Note that servers updated in May for the earlier HTTP/2 flaw, CVE-2026-23918, are still exposed to this one.
3. Where you cannot patch yet, turn off HTTP/2 by removing h2 and h2c from the Protocols setting, leaving only http/1.1, and check every virtual host as well as the main configuration. Test the change on one system before rolling it out.
4. Keep these web interfaces off the internet. Put them behind your own virtual private network (VPN) or jump host with multifactor authentication (MFA), and watch for unexpected crashes or restarts of the web service, which can be an early sign of someone probing the flaw.

Red Tiger has completed more than 500 OT security assessments and trained more than 4,500 people, and web servers buried inside vendor products are a common gap in asset inventories. We do more than find and fix weaknesses like this one. Our team can also install a firewall and sensor at the site, connect it to the Red Tiger 24x7 Security Operations Center (SOC), and monitor the site for ongoing detection and response as a 24x7 managed service, with metrics and reports, so traffic aimed at an exposed web server is spotted and handled quickly.

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources: Apache HTTP Server security advisory, 11 November 2026 https://httpd.apache.org/security/vulnerabilities_24.html ; NHS England cyber alert CC-4892, 12 November 2026 https://digital.nhs.uk/cyber-alerts/2026/cc-4892