Critical Apache Flaw Can Let Attackers Take Over Web Servers Without Logging In. Update to 2.4.71

If you run a website, a home lab or anything else on the Apache web server, put this at the top of today’s list. Apache has patched a critical flaw in its HTTP/2 module. Red Hat says an attacker can use it to run commands on a server without logging in. The fix is Apache HTTP Server 2.4.71, released November 11.

What the bug is

The flaw, CVE-2026-119618, is in mod_http2, the part of Apache that handles HTTP/2 connections. Apache’s security page rates it critical. It describes a thread-synchronization bug in the module’s assign_headers() code that “can lead to RCE” (remote code execution).

Red Hat’s explanation is plainer. HTTP/2 lets a browser send many requests at once over one connection, and Apache handles them on several threads. Because of the bug, one thread can write into memory that belongs to another and corrupt the server’s memory. A remote attacker who can reach the server could then run commands on it without logging in, which Red Hat says could lead to “a complete takeover.”

• Affected: Apache HTTP Server 2.4.55 through 2.4.70, and the standalone mod_h2 module 2.0.8 through 2.0.42.
• Only with HTTP/2 on: servers that serve only HTTP/1.1 are not vulnerable, per Red Hat.
• Severity: Red Hat scores it 9.8 out of 10 (CVSS 3.1) and says public research “has demonstrated a reliable exploit” against a default setup with mod_http2 enabled.
• Attacks in the wild: neither Apache nor Red Hat reports any so far.
• Who found it: Apache credits Anthropic’s OSS Scanner (reported October 26) and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research (reported November 3).

Security outlets including Cybersecurity News and Cyber Press are urging admins to update. Version 2.4.71 also fixes two lesser bugs: an “important” crash in mod_md and a “low” buffer overwrite in mod_vhost_alias.

Linux distros: it depends

Red Hat Enterprise Linux 8 and earlier aren’t affected. RHEL 9 and 10 have fixed mod_http2 packages out now. Red Hat rates the bug “Important” rather than critical there, because those builds give each HTTP/2 stream its own memory allocator, which makes it much harder to exploit. Red Hat JBoss Core Services and Red Hat Hardened Images are still listed as affected. If you run Apache in containers, rebuild your images on the patched packages.

On Debian, Ubuntu and other distros, the fix usually arrives as a patched package instead of a jump to 2.4.71. Check your distro’s security notices instead of relying on the version number alone.

What to do now

1. Check your version: run apachectl -v (or httpd -v).
2. Check whether HTTP/2 is on: look for h2 or h2c on a Protocols line in your Apache config.
3. Update: install 2.4.71 or your distro’s patched package, then restart Apache.
4. Can’t patch today? Since HTTP/1.1-only servers aren’t vulnerable, taking h2 and h2c out of Protocols and restarting is a stopgap. Browsers will fall back to HTTP/1.1 until you update.

If your site is on shared or managed hosting, this is your host’s job. It’s still worth asking them whether they’re patched, since many hosts run Apache.

PCGeek’s take

Unauthenticated remote code execution in one of the most common web servers, with a reliable exploit already shown in research, is about as serious as web bugs get. The good news is that the fix is already out and the stopgap is simple. Don’t wait for attacks to show up first.

It’s also another sign of where bug hunting is going. Both teams credited, Anthropic’s scanner and Google’s researchers, found this one separately, about a week apart. Automated tools are finding serious bugs in old, widely used code faster than before, so the patching side has to keep up.

Photo: server rack at NERSC by Derrick Coetzee, Wikimedia Commons, CC0. Stand-in photo, not a server from this story.

Running Apache at home or at work? Tell us whether you’ve patched yet in the comments.

Follow @pcgeekinfo for more security and PC news.