Apache 2.4.71 closes an HTTP/2 remote code execution race

Apache HTTP Server 2.4.71 closes a race condition in the HTTP/2 module that lets a remote, unauthenticated attacker corrupt heap memory and run arbitrary code as the web server process. The bug is CVE-2026-119618, and it sits in assign_headers() in mod_http2, where concurrent threads share resources without proper synchronization. Anthropic and Google Cloud’s Vulnerability Research Team found it independently. At the time Wiz published, there was no public exploit and no reports of exploitation in the wild.

The precondition is specific: HTTP/2 has to be enabled. mod_http2 multiplexes several streams over one connection and processes them concurrently, and the race is in how it assigns headers across those threads. An attacker who can drive requests over h2 or h2c forces the shared state into a corrupted heap, and heap corruption in a C server process is the familiar path to code execution. Whatever privileges httpd runs under are the privileges the attacker gets.

Wiz’s scan data puts 64% of cloud environments as having a resource vulnerable to this and 51% as having publicly exposed instances. Wiz notes the figures ignore configuration, so a host counted as vulnerable may not have HTTP/2 turned on. The exposure that matters is a public Apache that gets compromised and then reaches inward: adjacent microservices, and the cloud metadata endpoint at 169.254.169.254.

Fixing it

Upgrade to Apache HTTP Server 2.4.71 or later. If you build mod_h2 as a standalone module from GitHub rather than taking it from the httpd source tree, the fix lands in versions newer than 2.0.42.

If you can’t patch immediately, turn HTTP/2 off. Remove h2 and h2c from the Protocols directive so the server only speaks HTTP/1.1:

Protocols http/1.1

Two things to check while you’re in there. Protocols can be set per-vhost, so a global HTTP/1.1 line won’t help if a vhost overrides it with h2. And h2c is cleartext HTTP/2, reachable without TLS, so a plain port 80 listener is in scope if h2c is enabled. To find exposure, grep your configs for the Protocols directive and for h2 or h2c references; a build with HTTP/2 compiled in but not listed in Protocols is not serving it.