Apache CVE-2026-119618: which distro builds are fixed, how to check

The Apache HTTP Server project shipped version 2.4.71 on November 11 to fix CVE-2026-119618, a race condition in the mod_http2 module that corrupts heap memory and can lead to remote code execution. Apache rates it critical. It affects httpd 2.4.55 through 2.4.70, and the standalone mod_h2 module from GitHub in releases 2.0.8 through 2.0.42.

Red Hat, SUSE and Amazon all score it 9.8 on CVSS 3.1. No login is needed. The condition that narrows it: only servers with HTTP/2 enabled are exposed, and Red Hat says servers that speak only HTTP/1.1 are not affected.

The flaw was reported twice. Anthropic's OSS Scanner sent it to Apache's security team on October 26. Two researchers from Google Cloud Vulnerability Research, Anthony Weems and Simon Scannell, followed on November 3. The fix came 16 days after the first report.

The fix you install is your distro's, not 2.4.71

Most enterprise Apache servers do not run an upstream tarball. They run whatever the operating system vendor packages, and those vendors backport the fix into their own version numbers. Here is where each stood when we checked on November 12:

• Red Hat Enterprise Linux 10 and 9: fixed in mod_http2 errata RHSA-2026:98978 and RHSA-2026:98981, both dated November 11, with matching errata for the EUS and SAP streams. Red Hat rates its own builds Important, one step below critical, because they give every HTTP/2 stream its own memory allocator. RHEL 8 and earlier are not affected.
• Red Hat JBoss Core Services and Red Hat Hardened Images: listed as affected, with no errata yet.
• Debian: trixie is fixed in 2.4.71-1~deb13u1 (DSA-6620-1) and unstable (sid) in 2.4.71-1. Forky (testing) is still marked vulnerable. The tracker still marks bookworm as vulnerable even though a 2.4.71 build sits in its security repository, so do not assume bookworm is covered until the tracker says so.
• SUSE: status "Pending". SLES 15 SP7, SLES 16.0 and 16.1, openSUSE Leap 16, and the SLES 12 SP5 and 15 LTSS products are listed as affected, as are containers that bundle apache2, among them bci/php-apache and the SUSE Manager proxy and server images.
• Amazon Linux 2, 2023 and the 2027 Preview: "Pending Fix".
• Ubuntu: no CVE page yet.

One warning from Red Hat applies to every backporting distro: a fixed package keeps its old version number, so some scanners will keep flagging it as vulnerable. Check the advisory, not the version string.

Is it being exploited?

No source we read reports attacks, and the CVE was not in CISA's Known Exploited Vulnerabilities catalog on November 12. The sources disagree on how close an attack is. Wiz wrote on November 11 that no exploit is available. Red Hat's page says public research has produced "a reliable exploit" that works on a server in its default configuration once mod_http2 is switched on, but neither Red Hat nor any other page we read links to that research. Treat it as unconfirmed, and plan as if the gap will close quickly: Wiz counts vulnerable resources in 64% of the cloud environments it sees, though that figure ignores whether HTTP/2 is switched on.

What IT teams should do

• Find which servers are exposed. Run apachectl -M | grep http2 to see whether the module is loaded, then search the configuration for any Protocols line containing h2 or h2c, including lines inside individual virtual hosts.
• Patch public-facing servers with HTTP/2 on first. On RHEL 9 and 10 and Debian trixie, the fixed packages are out now.
• Where no package exists yet (SUSE, Amazon Linux, Ubuntu, Debian bookworm and forky), consider the stopgap Wiz suggests: set Protocols http/1.1 to turn HTTP/2 off. This comes from Wiz, not Apache, which lists no workaround, so test it before rolling it out.
• Restart Apache after patching so no old worker processes keep running.
• Ask vendors of appliances and containers that ship their own httpd for a fixed build. Red Hat's JBoss Core Services, still unpatched while RHEL 9 and 10 are fixed, shows that bundled copies can lag the operating system packages.
• If you build mod_h2 from GitHub, note that Apache names no fixed standalone release; moving to httpd 2.4.71 is the clear path.

Sources: Apache HTTP Server 2.4 vulnerabilities, Apache's announcement on oss-security, Red Hat, Debian security tracker, SUSE, Amazon Linux, Wiz, SOC Prime. Related: Brotli HTTP2Shell patch order, PHP2Shell patch paths.