SecurityWeek’s November 11 report sharpened the dispute over Apache HTTP Server’s CVE-2026-119618: Red Hat says public research demonstrated a reliable exploit, while Wiz said no exploit or in-the-wild use had been reported. The flaw affects Apache 2.4.55–2.4.70 and standalone mod_h2 2.0.8–2.0.42, but only when HTTP/2 is enabled; Apache fixed it in 2.4.71.
Several server threads can reach shared HTTP/2 header data at the wrong time, corrupting memory. SecurityWeek says the public proof of concept it cites reproduces that corruption and crashes Apache, not remote code execution, so the public evidence does not settle whether the race can reliably become code execution.
Affected-version totals are a poor proxy for exposure: HTTP/2-disabled servers are outside the flaw’s reach, while HTTP/2 can be enabled per virtual host or supplied through standalone mod_h2. For organizations tracking only core Apache packages, configuration and module packaging leave the actual exposed set uncertain.
Apache HTTP Server patches critical HTTP/2 remote code execution flaw
A critical vulnerability in the HTTP/2 module of Apache HTTP Server could be exploited by an unauthenticated attacker to obtain remote code execution (RCE).