{"slug":"apache-httpd-mod-http2-cve-2026-119618","title":"Apache HTTP Server mod_http2 race-condition RCE (CVE-2026-119618)","shortName":"Apache httpd","seoTitle":"Apache httpd (CVE-2026-119618): versions, exploitation & detection","summary":"Unauthenticated race in Apache HTTP Server mod_http2 assign_headers() (CVE-2026-119618, CWE-362). Apache rates it critical and says it can lead to RCE. Red Hat scores CVSS 3.1 9.8 and describes unauthenticated arbitrary command execution as the server process. Affected: httpd 2.4.55 to 2.4.70 and standalone mod_h2 2.0.8 to 2.0.42. Fixed in httpd 2.4.71 (11 Nov 2026). Reachable only where HTTP/2 is enabled (h2 or h2c). No known ITW. Not in CISA KEV (catalog 2026.11.10, checked 13 Nov 2026). Public PoC (DoS/crash only): SecurityWeek (12 Nov 2026; checked 13 Nov 2026) says a public GitHub PoC reproduces memory corruption and crashes without demonstrating RCE.","isExample":false,"draft":false,"family":"apache-httpd-mod-http2-cve-2026-119618","kind":"shared-component","aliases":["CVE-2026-119618","Apache HTTP Server mod_http2 race","mod_http2 assign_headers RCE","mod_h2 heap corruption"],"publishedAt":"2026-11-13","updatedAt":"2026-11-13","patchStatus":"partly-patched","exploited":false,"scores":{"cve":"CVE-2026-119618","cvss":{"cve":"CVE-2026-119618","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://access.redhat.com/security/cve/cve-2026-119618","sourceDate":"2026-11-11","checkedDate":"2026-11-13","dateLabel":"Red Hat dated","sourceLabel":"Red Hat (CVSS 3.1 9.8). Apache CNA published a textual critical rating with no numeric CVSS. NVD CVE 2.0 API 13 Nov 2026: Awaiting Analysis, empty metrics, published 2026-11-11T15:17:15.900, lastModified 2026-11-12T21:17:20.893. No CISA ADP metric.","nvdPublishedDate":"2026-11-11"},"epss":{"cve":"CVE-2026-119618","score":0.00398,"percentile":0.34546,"date":"2026-11-12","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-119618","checkedDate":"2026-11-13"},"kev":{"cve":"CVE-2026-119618","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.11.10","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-13"},"addedDate":"2026-11-13"},"priority":{"label":"high"},"managementSummary":{"what":"Unauthenticated race in Apache HTTP Server mod_http2 assign_headers() (CVE-2026-119618, Apache critical; Red Hat CVSS 3.1 9.8). Apache says it can lead to RCE. Red Hat describes unauthenticated arbitrary command execution as the server process. Reachable only where HTTP/2 (h2 or h2c) is enabled. No known ITW. Not in CISA KEV (checked 13 Nov 2026). The public PoC is DoS/crash only, not demonstrated RCE.","action":"Upgrade to httpd 2.4.71 or the distro backport and restart. If you cannot patch, set Protocols http/1.1 on the server and every virtual host (CIRCL, Wiz). Inventory which servers and vhosts enable h2 or h2c. Distro backports may keep a version string below 2.4.71; check the vendor advisory (Praetorian)."},"seenInTheWild":[{"metric":"possibly-vulnerable","value":"64% of cloud environments had resources in the affected version range; 51% had publicly exposed instances","observer":"Wiz","date":"2026-11-11","method":"Wiz Research data on cloud environments. Wiz: this does not take configuration into account, so it is not a count of HTTP/2-enabled or exploitable installs.","sourceUrl":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability","note":"Version presence only. HTTP/2 must be enabled for the bug to be reachable (CIRCL TR-103)."}],"whatChanged":{"date":"2026-11-13","items":[{"text":"New catalog page for Apache HTTP Server mod_http2 race-condition RCE CVE-2026-119618.","headline":"New catalog page for Apache HTTP Server mod_http2 CVE-2026-119618","section":"overview","date":"2026-11-13","kind":"page"},{"text":"Apache HTTP Server 2.4.71 (released 11 Nov 2026, commit 824beab) fixes CVE-2026-119618. The same release also fixes CVE-2026-106023 (mod_md pointer dereference, important) and CVE-2026-109163 (mod_vhost_alias 1-byte stack overwrite, low); those are not this bug. Red Hat shipped RHEL 9 RHSA-2026:98981 (mod_http2-2.0.26-7.el9_9.1) and RHEL 10 RHSA-2026:98978 (mod_http2-2.0.29-5.el10_3.1), plus EUS errata, per The Hacker News. Debian unstable has apache2 2.4.71-1 (Trend Micro). Standalone mod_h2 has no patched release published and the GitHub repo is archived (Trend Micro). Distro backports may keep a version string below 2.4.71 (Praetorian); check the vendor advisory.","headline":"Apache 2.4.71 and RHEL 9/10 packages are the fix; standalone mod_h2 has none","section":"fixed-versions","date":"2026-11-13","sourceUrl":"https://httpd.apache.org/security/vulnerabilities_24.html","alsoSourceUrl":"https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html","addedDate":"2026-11-13"},{"text":"No known in-the-wild use. Wiz (11 Nov 2026) saw no exploit and no ITW. Red Hat says public research demonstrated a reliable exploit against a default config with HTTP/2 enabled but names no source; CIRCL TR-103 notes that does not establish ITW. SecurityWeek (Eduard Kovacs, 12 Nov 2026; checked 13 Nov 2026) says the public GitHub PoC reproduces memory corruption and process crashes without demonstrating RCE. Badge: No known ITW. PoC: Public PoC (DoS/crash only). Not in CISA KEV (catalog 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries, checked 13 Nov 2026).","headline":"No known ITW; public GitHub PoC is crash only; not in KEV","section":"exploitation","date":"2026-11-13","sourceUrl":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability","alsoSourceUrl":"https://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google/","addedDate":"2026-11-13"}]},"whatTheBugIs":"CVE-2026-119618 is a race in Apache HTTP Server's HTTP/2 module (mod_http2) in assign_headers(). Apache CNA title: mod_http2: heap corruption and RCE in assign_headers. CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). Apache rates it critical and publishes no numeric CVSS. A worker thread can write into connection-owned heap memory through a shared allocator. Apache: this can lead to RCE. Red Hat: unauthenticated arbitrary command execution as the server process.\n\nPreconditions. No authentication. HTTP/2 must be enabled (h2 or h2c in a Protocols directive, server-wide or per virtual host). CIRCL TR-103: HTTP/1.1-only servers, and servers that merely load mod_http2, are not reachable. Apache's core default is Protocols http/1.1; loading the module does not turn HTTP/2 on by itself. A virtual host can override the base server.\n\nAffected. Apache HTTP Server 2.4.55 through 2.4.70. Standalone mod_h2 from GitHub 2.0.8 through 2.0.42. Fixed in Apache HTTP Server 2.4.71, released 11 Nov 2026 (commit 824beab). Trend Micro: no patched standalone mod_h2 has been published and the repository has been archived since 9 June 2026.\n\nThe same 2.4.71 release also fixes CVE-2026-106023 (mod_md pointer dereference, important) and CVE-2026-109163 (mod_vhost_alias 1-byte stack overwrite, low). Those are not this bug and are not aliases on this page.\n\nSeverity. Apache: critical. Red Hat: CVSS 3.1 9.8 for the general assessment. Red Hat rates RHEL 9 and 10 Important because those builds use a per-stream allocator, which makes exploitation substantially harder. Red Hat states RHEL 8 and earlier are not affected (code before mod_http2 2.0.8 does not contain the flaw). NVD on 13 Nov 2026: Awaiting Analysis, empty metrics.\n\nExploitation. No known in-the-wild use. Badge: No known ITW. Wiz (11 Nov 2026): no exploit available and no reports of exploitation in the wild. Red Hat says public research demonstrated a reliable exploit against a default-configured server with mod_http2 enabled, and does not name that research. CIRCL TR-103: that demonstration does not, by itself, establish exploitation in the wild. Not in CISA KEV (catalog 2026.11.10, 1,779 entries, checked 13 Nov 2026).\n\nPoC. SecurityWeek (Eduard Kovacs, 12 Nov 2026; checked 13 Nov 2026) says a public GitHub proof of concept reproduces memory corruption and Apache process crashes but does not demonstrate remote code execution. Not independently validated for RCE. Listed for defenders. This site does not link the PoC repository and does not copy exploit code.\n\nCredit. Anthropic OSS Scanner (ANT-2026-MAPKT6MZ), reported 26 Oct 2026. Anthony Weems and Simon Scannell, Google Cloud Vulnerability Research, reported 3 Nov 2026 (CVE record timeline 2026-11-03T15:50:00.000Z). Analysis: Wiz (11 Nov 2026), CIRCL TR-103 (12 Nov 2026), Praetorian (12 Nov 2026).","attackPath":{"caption":"High-level only. Not a reproduction guide. No payloads, stream counts, or usage steps. Apache: can lead to RCE. Red Hat: unauthenticated arbitrary command execution as the server process. That is not a claim of root.","steps":[{"id":"reach","label":"Unauthenticated HTTP/2 client","detail":"A client that can reach an HTTP/2-enabled listener (h2 or h2c) needs no authentication."},{"id":"unsafe","label":"Many concurrent streams","detail":"Concurrent streams on one connection widen the race in assign_headers()."},{"id":"exec","label":"Heap corruption in the child","detail":"A worker thread can write into connection-owned heap memory through a shared allocator."},{"id":"shell","label":"Possible code as the httpd account","detail":"Apache: can lead to RCE. Red Hat: commands run as the server process, not necessarily root."}]},"exploitation":{"kev":{"listed":false,"date":"2026-11-10","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Not in CISA KEV (checked 13 Nov 2026) against catalog 2026.11.10 (released 2026-11-10T19:03:29.8375Z, 1,779 entries). CVE-2026-119618 has no catalog row."},"firstSeen":{"date":null,"source":"Wiz 11 Nov 2026. Red Hat CVE-2026-119618. CIRCL TR-103 12 Nov 2026. SecurityWeek 12 Nov 2026. CISA KEV catalog 2026.11.10.","note":"No known in-the-wild use. Wiz (11 Nov 2026) saw no exploit and no ITW. Red Hat says public research demonstrated a reliable exploit against a default config with HTTP/2 enabled but names no source. CIRCL: that does not establish ITW. Badge: No known ITW."},"vendorStatements":[{"vendor":"Apache HTTP Server","date":"2026-11-11","statement":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.","url":"https://httpd.apache.org/security/vulnerabilities_24.html","retracted":false},{"vendor":"Red Hat","date":"2026-11-11","statement":"A remote attacker who can reach the web server could exploit this flaw to execute arbitrary commands on the server without any authentication. Only servers that have HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable. Public research has demonstrated a reliable exploit against a default-configured server with the mod_http2 module enabled.","url":"https://access.redhat.com/security/cve/cve-2026-119618","retracted":false},{"vendor":"Red Hat","date":"2026-11-11","statement":"The severity for Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 is therefore rated Important rather than Critical. Versions of mod_http2 prior to 2.0.8 do not contain the affected code, and Red Hat Enterprise Linux 8 and earlier are not affected.","url":"https://access.redhat.com/security/cve/cve-2026-119618","retracted":false}]},"timeline":[{"date":"2026-10-26","event":"Anthropic OSS Scanner reported the flaw to Apache as ANT-2026-MAPKT6MZ.","source":{"title":"Apache HTTP Server 2.4 vulnerabilities (CVE-2026-119618)","url":"https://httpd.apache.org/security/vulnerabilities_24.html","publisher":"Apache HTTP Server"},"kind":"disclosure","key":true,"addedDate":"2026-11-13"},{"date":"2026-11-03T15:50:00.000Z","event":"Anthony Weems and Simon Scannell (Google Cloud Vulnerability Research) reported the same flaw to Apache.","source":{"title":"CVE-2026-119618 (CVE.org record)","url":"https://www.cve.org/CVERecord?id=CVE-2026-119618","publisher":"CVE.org / Apache CNA"},"kind":"disclosure","key":true,"addedDate":"2026-11-13"},{"date":"2026-11-11","event":"Apache HTTP Server 2.4.71 released. Fixes CVE-2026-119618 (critical), plus CVE-2026-106023 (important) and CVE-2026-109163 (low). Commit 824beab.","source":{"title":"Fixed in Apache HTTP Server 2.4.71","url":"https://httpd.apache.org/security/vulnerabilities_24.html","publisher":"Apache HTTP Server"},"kind":"patch","key":true,"addedDate":"2026-11-13"},{"date":"2026-11-11T12:19:30Z","event":"Eric Covener posted CVE-2026-119618 to oss-security. Severity critical. Affected 2.4.55 through 2.4.70 and mod_h2 2.0.8 through 2.0.42.","source":{"title":"oss-security: CVE-2026-119618","url":"https://www.openwall.com/lists/oss-security/2026/11/11/13","publisher":"oss-security"},"kind":"advisory","key":true,"addedDate":"2026-11-13"},{"date":"2026-11-11T14:54:08.155Z","event":"CVE.org published CVE-2026-119618 (Apache CNA). NVD published 2026-11-11T15:17:15.900Z, lastModified 2026-11-12T21:17:20.893Z, vulnStatus Awaiting Analysis, empty metrics.","source":{"title":"NVD CVE-2026-119618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119618","publisher":"NVD"},"kind":"advisory","addedDate":"2026-11-13"},{"date":"2026-11-11","event":"Wiz: no exploit available and no reports of exploitation in the wild. Wiz also published cloud version-presence figures that do not account for HTTP/2 configuration.","source":{"title":"Critical RCE Vulnerability in Apache HTTP Server","url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability","publisher":"Wiz"},"kind":"other","key":true,"addedDate":"2026-11-13"},{"date":"2026-11-11","event":"Red Hat published CVE-2026-119618: CVSS 3.1 9.8; RHEL 9/10 Important because of per-stream allocators; RHEL 8 and earlier not affected. Public research demonstrated a reliable exploit against a default config with HTTP/2 enabled; Red Hat names no source.","source":{"title":"Red Hat CVE-2026-119618","url":"https://access.redhat.com/security/cve/cve-2026-119618","publisher":"Red Hat"},"kind":"vendor","addedDate":"2026-11-13"},{"date":"2026-11-11","event":"The Hacker News: RHEL 9 RHSA-2026:98981 (mod_http2-2.0.26-7.el9_9.1) and RHEL 10 RHSA-2026:98978 (mod_http2-2.0.29-5.el10_3.1), plus EUS errata RHSA-2026:98968, 98954, 98982, 98953, and 98979.","source":{"title":"Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely","url":"https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html","publisher":"The Hacker News"},"kind":"vendor","addedDate":"2026-11-13"},{"date":"2026-11-12","event":"CIRCL published TR-103. HTTP/2 must be enabled for reachability. Red Hat's demonstrated exploit does not establish ITW. Workaround: Protocols http/1.1 on every relevant virtual host.","source":{"title":"CIRCL TR-103","url":"https://www.circl.lu/pub/tr-103/","publisher":"CIRCL"},"kind":"other","addedDate":"2026-11-13"},{"date":"2026-11-12","event":"Praetorian: distro backports may keep a version string below 2.4.71, so check the vendor advisory. Inventory LoadModule http2_module and Protocols h2/h2c.","source":{"title":"CVE-2026-119618: What We Know About the Critical Apache mod_http2 Race Condition","url":"https://www.praetorian.com/blog/cve-2026-119618","publisher":"Praetorian"},"kind":"other","addedDate":"2026-11-13"},{"date":"2026-11-12","event":"Trend Micro KA-0025062: no patched standalone mod_h2 published; repository archived since 9 June 2026. Debian unstable apache2 2.4.71-1. Detection: child crashes under HTTP/2 load, shells spawned by the httpd user, FIM on document roots, egress from web servers. TrendAI signatures under investigation.","source":{"title":"Trend Micro KA-0025062","url":"https://success.trendmicro.com/en-US/solution/KA-0025062","publisher":"Trend Micro"},"kind":"vendor","addedDate":"2026-11-13"},{"date":"2026-11-12","event":"SecurityWeek (Eduard Kovacs, 12 Nov 2026): a public GitHub PoC reproduces memory corruption and process crashes without demonstrating RCE.","source":{"title":"Apache Patches Critical HTTP Server RCE Found by Anthropic, Google","url":"https://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google/","publisher":"SecurityWeek"},"kind":"poc","key":true,"addedDate":"2026-11-13"},{"date":"2026-11-13","event":"Not in CISA KEV. Catalog 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries. CVE-2026-119618 has no catalog row. Checked 13 Nov 2026.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","key":true,"addedDate":"2026-11-13"}],"openNotes":[{"title":"Red Hat's demonstrated exploit is not ITW","detail":"Red Hat says public research demonstrated a reliable exploit against a default-configured server with mod_http2 enabled, and does not name that research. Wiz (11 Nov 2026) said no exploit was available and no ITW had been reported. CIRCL TR-103: the Red Hat statement does not, by itself, establish exploitation in the wild. This page keeps that split. Badge: No known ITW.","sources":[{"url":"https://access.redhat.com/security/cve/cve-2026-119618","date":"2026-11-11","publisher":"Red Hat"},{"url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability","date":"2026-11-11","publisher":"Wiz"},{"url":"https://www.circl.lu/pub/tr-103/","date":"2026-11-12","publisher":"CIRCL"}]},{"title":"Wiz standalone mod_h2 patched-version table disagrees with Trend Micro","detail":"Wiz's affected-products table lists standalone mod_h2 patched versions as 2.0.42 and newer. 2.0.42 is the last affected version on Apache's advisory. Trend Micro and The Hacker News: no patched standalone release has been published and the repository has been archived since 9 June 2026. This page uses Trend Micro / The Hacker News for the standalone-module fix status.","sources":[{"url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability","date":"2026-11-11","publisher":"Wiz"},{"url":"https://success.trendmicro.com/en-US/solution/KA-0025062","date":"2026-11-12","publisher":"Trend Micro"}]},{"title":"Debian stable was not fetched from Debian's tracker","detail":"Trend Micro lists Debian unstable apache2 2.4.71-1. The Hacker News 12 Nov table lists Debian bookworm, trixie, and forky as Vulnerable from Debian's security tracker. This page did not fetch that tracker and does not treat the THN row as a Debian vendor statement. Debian stable on this page is no statement yet.","sources":[{"url":"https://success.trendmicro.com/en-US/solution/KA-0025062","date":"2026-11-12","publisher":"Trend Micro"},{"url":"https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html","date":"2026-11-12","publisher":"The Hacker News"}]},{"title":"THN extra distro rows were not added to the matrix","detail":"The Hacker News 12 Nov table also lists Amazon Linux 2 / 2023 / 2027 Preview as pending, Ubuntu as no status page, and Red Hat JBoss Core Services / Hardened Images as affected with no fix listed. Those trackers were not fetched for this page, so they are not matrix rows.","sources":[{"url":"https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html","date":"2026-11-12","publisher":"The Hacker News"}]}],"defenderActions":[{"title":"Upgrade to 2.4.71 or the distro backport, then restart","detail":"Apache: 2.4.71. Red Hat: RHEL 9 RHSA-2026:98981 and RHEL 10 RHSA-2026:98978 (The Hacker News). Debian unstable: apache2 2.4.71-1 (Trend Micro). Restart httpd so the running children load the fixed module. Distro backports may keep a version string below 2.4.71; check the vendor advisory (Praetorian).","priority":"now","links":[{"label":"Apache 2.4 security advisories","href":"https://httpd.apache.org/security/vulnerabilities_24.html"},{"label":"Red Hat CVE-2026-119618","href":"https://access.redhat.com/security/cve/cve-2026-119618"}]},{"title":"If you cannot patch, set Protocols http/1.1 everywhere","detail":"CIRCL and Wiz: remove h2 and h2c from every Protocols directive, server-wide and per virtual host, leaving Protocols http/1.1. Test apachectl -t, then reload or restart. This blocks reachability of this bug; it does not remove the vulnerable code. Apache publishes no other workaround (Trend Micro, The Hacker News).","priority":"now","links":[{"label":"CIRCL TR-103","href":"https://www.circl.lu/pub/tr-103/"},{"label":"Wiz advisory","href":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability"}]},{"title":"Inventory which servers and vhosts enable h2 or h2c","detail":"CIRCL: apachectl -M | grep http2, apachectl -S, and grep Protocols under /etc/apache2 or /etc/httpd, including virtual-host overrides. Loading mod_http2 is not enough for reachability; HTTP/2 must be enabled.","priority":"now","links":[{"label":"CIRCL TR-103 verification","href":"https://www.circl.lu/pub/tr-103/"}]}],"detection":[{"title":"Repeated httpd child crashes under HTTP/2 load","detail":"Trend Micro and CIRCL: look in Apache error_log for mod_http2 crash or assertion messages and repeated child-process restarts under HTTP/2 load. A race that is not won cleanly usually kills a child. A hit is a lead, not proof of this CVE. No public Nuclei rule or vendor IDS signature was published as of 13 Nov 2026 (Trend Micro: TrendAI protections under investigation).","logSource":"Apache error_log / journald for httpd or apache2","kind":"generic","group":"web-proxy","url":"https://success.trendmicro.com/en-US/solution/KA-0025062","date":"2026-11-12","described":true},{"title":"Shells or unexpected children spawned by the httpd user","detail":"Trend Micro: command shells spawned by the httpd user. CIRCL: suspicious child-process creation. Hunt EDR process telemetry for httpd or apache2 launching sh, bash, curl, or wget. A hit is a lead, not proof.","logSource":"EDR process telemetry (httpd/apache2 parent, child process, command line)","kind":"generic","group":"edr","url":"https://success.trendmicro.com/en-US/solution/KA-0025062","date":"2026-11-12","described":true},{"title":"Unexpected file changes under document roots","detail":"Trend Micro: new or modified files under the document root. CIRCL: unauthorised file changes. FIM on document roots is a compromise check, not a signature.","logSource":"FIM / EDR file events on document roots","kind":"generic","group":"edr","url":"https://success.trendmicro.com/en-US/solution/KA-0025062","date":"2026-11-12","fold":"compromise-check","described":true},{"title":"Unexpected egress from web servers","detail":"Trend Micro: unexpected outbound connections from the web server. CIRCL: unexpected outbound connections. Correlate with httpd user traffic. No vendor IOC list was published.","logSource":"Egress / proxy logs from web-server hosts","kind":"generic","group":"edr","url":"https://www.circl.lu/pub/tr-103/","date":"2026-11-12","described":true}],"detectionRules":[],"detectionLinks":[],"amIAffected":{"summary":"httpd 2.4.55 through 2.4.70, or standalone mod_h2 2.0.8 through 2.0.42, with HTTP/2 enabled (h2 or h2c). Loading mod_http2 is not enough. Inventory version, package, Protocols, and internet exposure. Do not send crafted HTTP/2 streams as a test.","checks":[{"id":"v2s-aia-apache-httpd-mod-http2-cve-2026-119618-version-1","kind":"version","title":"Record the installed httpd version","detail":"Apache: affected 2.4.55 through 2.4.70; fixed in 2.4.71. CIRCL: apachectl -v. Distro backports may keep a version string below 2.4.71 (Praetorian); also record the vendor advisory.","command":"Record apachectl -v (or httpd -v) on each web server, then compare it to 2.4.71 or the distro advisory for that host.","affectedMeans":"httpd is 2.4.55 through 2.4.70 and is not a sourced backport for CVE-2026-119618.","fixedMeans":"httpd is 2.4.71 or a sourced vendor backport, or httpd is not installed.","notes":"RHEL 8 and earlier: Red Hat vendor statement, not affected. Do not probe the bug.","sources":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","date":"2026-11-11","publisher":"Apache HTTP Server"},{"url":"https://www.circl.lu/pub/tr-103/","date":"2026-11-12","publisher":"CIRCL"}]},{"id":"v2s-aia-apache-httpd-mod-http2-cve-2026-119618-package-1","kind":"package","title":"Record the distro httpd / mod_http2 package","detail":"The Hacker News: RHEL 9 RHSA-2026:98981 (mod_http2-2.0.26-7.el9_9.1); RHEL 10 RHSA-2026:98978 (mod_http2-2.0.29-5.el10_3.1). Trend Micro: Debian unstable apache2 2.4.71-1. Standalone mod_h2 2.0.8 through 2.0.42 has no published fix.","command":"Record rpm -q httpd mod_http2 or dpkg -l apache2 libapache2-mod-http2, and whether a standalone mod_h2 build is loaded.","affectedMeans":"The package is below the sourced advisory, or standalone mod_h2 is 2.0.8 through 2.0.42.","fixedMeans":"The package matches a sourced advisory, or the host is RHEL 8 or earlier (Red Hat statement).","notes":"Debian stable: no statement yet on this page.","sources":[{"url":"https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html","date":"2026-11-12","publisher":"The Hacker News"},{"url":"https://success.trendmicro.com/en-US/solution/KA-0025062","date":"2026-11-12","publisher":"Trend Micro"}]},{"id":"v2s-aia-apache-httpd-mod-http2-cve-2026-119618-config-1","kind":"config","title":"Record whether Protocols enables h2 or h2c","detail":"CIRCL: the vulnerable path is not reachable merely because mod_http2 is loaded. grep Protocols under /etc/apache2 and /etc/httpd, including virtual hosts. apachectl -M | grep -i http2 and apachectl -S.","command":"Record grep -RniE '^[[:space:]]*Protocols[[:space:]]+' /etc/apache2 /etc/httpd 2>/dev/null and apachectl -M | grep -i http2 on each server you own.","affectedMeans":"An unpatched httpd has h2 or h2c in a server-wide or vhost Protocols line.","fixedMeans":"Every Protocols line is http/1.1 only, or httpd is patched, or mod_http2 is not loaded.","notes":"CIRCL: a reverse proxy that terminates HTTP/2 and forwards HTTP/1.1 to Apache does not by itself make this Apache bug reachable. Confirm the protocol between each frontend and Apache. Do not send crafted streams.","sources":[{"url":"https://www.circl.lu/pub/tr-103/","date":"2026-11-12","publisher":"CIRCL"},{"url":"https://www.praetorian.com/blog/cve-2026-119618","date":"2026-11-12","publisher":"Praetorian"}]},{"id":"v2s-aia-apache-httpd-mod-http2-cve-2026-119618-exposure-1","kind":"exposure","title":"Record internet-facing httpd in your range","detail":"Wiz (11 Nov 2026) reported publicly exposed instances in its cloud data, without configuration. Scope any host search to your estate. This is inventory, not a probe of the bug.","command":"product:\"Apache httpd\" net:<your-range>","affectedMeans":"An unpatched httpd in your range is reachable from the internet.","fixedMeans":"No matching hosts, or matching hosts are patched / HTTP/1.1-only.","notes":"Replace net:<your-range> with org:\"<your org>\" if that is how you search. Do not scan third-party space.","sources":[{"url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability","date":"2026-11-11","publisher":"Wiz"}]}],"limits":["Do not send crafted HTTP/2 streams as a test.","CIRCL curl --http2 checks are protocol inventory of hosts you own, not a vulnerability exploit.","Debian stable, Ubuntu, Amazon Linux, and named appliances had no vendor statement fetched for this page as of 13 Nov 2026.","RHEL 8 and earlier is a Red Hat vendor statement, not a guess."],"sources":[{"url":"https://www.circl.lu/pub/tr-103/","date":"2026-11-12","publisher":"CIRCL"},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","date":"2026-11-11","publisher":"Apache HTTP Server"}],"updatedAt":"2026-11-13","addedDate":"2026-11-13"},"mitigations":{"summary":"CIRCL and Wiz document a temporary workaround: set Protocols http/1.1 everywhere so HTTP/2 is not reachable. Apache publishes no other workaround (Trend Micro, The Hacker News). The workaround does not remove the vulnerable code. Patch remains the fix.","items":[{"title":"Set Protocols http/1.1 on the server and every virtual host","detail":"CIRCL and Wiz: remove h2 and h2c from every Protocols directive. Leave Protocols http/1.1. CIRCL: a vhost can override the base server, so check every host. Unloading mod_http2 is another CIRCL option if nothing depends on it.","limits":"This prevents reachability of this bug; it does not patch assign_headers(). Clients fall back to HTTP/1.1. Test applications that require HTTP/2. Apache publishes no other workaround.","verify":"grep Protocols under /etc/apache2 and /etc/httpd (including vhosts) shows no h2 or h2c. apachectl -t succeeds. After reload, a check from a host you own no longer negotiates HTTP/2.","source":{"url":"https://www.circl.lu/pub/tr-103/","date":"2026-11-12","publisher":"CIRCL"}}],"updatedAt":"2026-11-13","addedDate":"2026-11-13"},"response":{"summary":"If an unpatched HTTP/2-enabled httpd was reachable, patch or disable HTTP/2, then hunt error_log crash bursts, httpd-user shells, document-root file changes, and unexpected egress. No vendor IOCs were published. No known ITW as of 13 Nov 2026. This is not a claim of compromise.","containment":[{"title":"Upgrade httpd and restart children","detail":"Install 2.4.71 or the distro backport. Restart so running children load the fixed module. Trend Micro: a patched binary does nothing until the process restarts, including containers and auto-scaling images.","sources":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","date":"2026-11-11","publisher":"Apache HTTP Server"},{"url":"https://success.trendmicro.com/en-US/solution/KA-0025062","date":"2026-11-12","publisher":"Trend Micro"}]},{"title":"If you cannot patch, disable HTTP/2 now","detail":"CIRCL and Wiz: Protocols http/1.1 on every relevant virtual host, then reload. This is temporary. Patch remains the fix.","sources":[{"url":"https://www.circl.lu/pub/tr-103/","date":"2026-11-12","publisher":"CIRCL"}]},{"title":"Hunt crash, process, file, and egress telemetry","detail":"Trend Micro and CIRCL: repeated child crashes under HTTP/2 load, shells from the httpd user, document-root file changes, unexpected outbound connections. A hit is a lead, not proof.","sources":[{"url":"https://success.trendmicro.com/en-US/solution/KA-0025062","date":"2026-11-12","publisher":"Trend Micro"},{"url":"https://www.circl.lu/pub/tr-103/","date":"2026-11-12","publisher":"CIRCL"}]}],"rotate":[{"item":"TLS keys, application secrets, and credentials readable by the httpd user","reason":"Trend Micro describes what successful code execution as the web-server account could read. No sourced ITW theft. Generic IR if you have a hit.","generic":true,"sources":[{"url":"https://success.trendmicro.com/en-US/solution/KA-0025062","date":"2026-11-12","publisher":"Trend Micro"}]}],"observedBehaviour":[{"title":"Child-process crashes rather than a clean failure","detail":"Trend Micro: a race that is not won cleanly usually kills a child process, which appears in logs as instability rather than attack traffic. CIRCL lists unexpected worker crashes as an investigative lead. Not proof of this CVE, and not ITW.","sourceUrl":"https://success.trendmicro.com/en-US/solution/KA-0025062","sourceDate":"2026-11-12"}],"evidence":[{"title":"Installed httpd / mod_http2 version from before the upgrade","detail":"Keep apachectl -v, package queries, and the vendor advisory you compared against, including whether HTTP/2 was enabled.","sources":[{"url":"https://www.circl.lu/pub/tr-103/","date":"2026-11-12","publisher":"CIRCL"}]},{"title":"error_log crash bursts and EDR process trees","detail":"Keep Apache error_log around HTTP/2 load, httpd parent/child process trees, FIM on document roots, and egress logs. No sourced persistence path was published.","generic":true,"sources":[{"url":"https://success.trendmicro.com/en-US/solution/KA-0025062","date":"2026-11-12","publisher":"Trend Micro"}]}],"limits":["No vendor IOCs were published.","No known in-the-wild use as of 13 Nov 2026.","A child crash, an httpd child process, or a document-root write is a lead, not proof of this CVE.","Trend Micro's web-shell impact language is what successful RCE could do, not a sourced implant path."],"sources":[{"url":"https://success.trendmicro.com/en-US/solution/KA-0025062","date":"2026-11-12","publisher":"Trend Micro"},{"url":"https://www.circl.lu/pub/tr-103/","date":"2026-11-12","publisher":"CIRCL"}],"updatedAt":"2026-11-13","addedDate":"2026-11-13"},"bulletins":[{"vendor":"Apache HTTP Server","title":"CVE-2026-119618 (critical) in 2.4.71","url":"https://httpd.apache.org/security/vulnerabilities_24.html","date":"2026-11-11","cve":"CVE-2026-119618"},{"vendor":"Red Hat","title":"CVE-2026-119618","url":"https://access.redhat.com/security/cve/cve-2026-119618","date":"2026-11-11","cve":"CVE-2026-119618"},{"vendor":"Trend Micro","title":"KA-0025062 (TrendAI protections under investigation)","url":"https://success.trendmicro.com/en-US/solution/KA-0025062","date":"2026-11-12","cve":"CVE-2026-119618"}],"coverage":[{"title":"Apache HTTP Server 2.4 vulnerabilities (CVE-2026-119618)","publisher":"Apache HTTP Server","url":"https://httpd.apache.org/security/vulnerabilities_24.html","date":"2026-11-11","type":"vendor","addedDate":"2026-11-13"},{"title":"oss-security: CVE-2026-119618","publisher":"oss-security / Eric Covener","url":"https://www.openwall.com/lists/oss-security/2026/11/11/13","date":"2026-11-11","type":"vendor","addedDate":"2026-11-13"},{"title":"Red Hat CVE-2026-119618","publisher":"Red Hat","url":"https://access.redhat.com/security/cve/cve-2026-119618","date":"2026-11-11","type":"vendor","addedDate":"2026-11-13"},{"title":"Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely","publisher":"The Hacker News / Swati Khandelwal","url":"https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html","date":"2026-11-12","type":"news","addedDate":"2026-11-13"},{"title":"Apache Patches Critical HTTP Server RCE Found by Anthropic, Google","publisher":"SecurityWeek / Eduard Kovacs","url":"https://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google/","date":"2026-11-12","type":"news","addedDate":"2026-11-13"},{"title":"Critical RCE Vulnerability in Apache HTTP Server","publisher":"Wiz / Merav Bar","url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability","date":"2026-11-11","type":"research","addedDate":"2026-11-13"},{"title":"CIRCL TR-103","publisher":"CIRCL","url":"https://www.circl.lu/pub/tr-103/","date":"2026-11-12","type":"government","addedDate":"2026-11-13"},{"title":"Trend Micro KA-0025062","publisher":"Trend Micro","url":"https://success.trendmicro.com/en-US/solution/KA-0025062","date":"2026-11-12","type":"vendor","addedDate":"2026-11-13"},{"title":"CVE-2026-119618: What We Know About the Critical Apache mod_http2 Race Condition","publisher":"Praetorian","url":"https://www.praetorian.com/blog/cve-2026-119618","date":"2026-11-12","type":"research","addedDate":"2026-11-13"},{"title":"CISA KEV catalog JSON (CVE-2026-119618 not listed; catalog 2026.11.10, 1,779 entries)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-13","type":"government","addedDate":"2026-11-13"}],"posts":[],"research":[{"title":"CIRCL TR-103","url":"https://www.circl.lu/pub/tr-103/","authors":"CIRCL","date":"2026-11-12"},{"title":"Wiz: Critical RCE Vulnerability in Apache HTTP Server","url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability","authors":"Merav Bar","date":"2026-11-11"},{"title":"Praetorian: CVE-2026-119618","url":"https://www.praetorian.com/blog/cve-2026-119618","authors":"Praetorian Unit-O1 / Michelle Rhodes","date":"2026-11-12"}],"impact":{"kind":"shared-component","component":"Apache HTTP Server mod_http2","matrixNote":"Reachable only where HTTP/2 is enabled (h2 or h2c). Distro backports may keep a version string below 2.4.71; check the vendor advisory. Standalone mod_h2 has no published fix. Never read silence as safe.","downstream":[{"product":"Apache HTTP Server","vendor":"Apache Software Foundation","type":"cms-app","notes":"Update 2.4.71 released 11 Nov 2026. Commit 824beab.","status":"affected","versions":"2.4.55 through 2.4.70; fixed in 2.4.71","vendorStatement":{"date":"11 Nov 2026","url":"https://httpd.apache.org/security/vulnerabilities_24.html","quote":"This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70."},"addedDate":"2026-11-13"},{"product":"standalone mod_h2","vendor":"Apache HTTP Server (GitHub mod_h2)","type":"cms-app","notes":"Trend Micro (12 Nov 2026): no patched standalone mod_h2 published; repository archived since 9 June 2026. Protocols http/1.1 also applies to these builds (The Hacker News).","status":"affected","versions":"2.0.8 through 2.0.42; no patched release published","vendorStatement":{"date":"11 Nov 2026","url":"https://httpd.apache.org/security/vulnerabilities_24.html","quote":"Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42."},"addedDate":"2026-11-13"},{"product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","type":"linux-distro","notes":"The Hacker News: RHSA-2026:98981, package mod_http2-2.0.26-7.el9_9.1. EUS errata listed on that article. Per-stream allocators make exploitation harder (Red Hat); still patch.","status":"affected","versions":"fixed in RHSA-2026:98981 (mod_http2-2.0.26-7.el9_9.1)","vendorStatement":{"date":"11 Nov 2026","url":"https://access.redhat.com/security/cve/cve-2026-119618","quote":"The severity for Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 is therefore rated Important rather than Critical."},"addedDate":"2026-11-13"},{"product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","type":"linux-distro","notes":"The Hacker News: RHSA-2026:98978, package mod_http2-2.0.29-5.el10_3.1.","status":"affected","versions":"fixed in RHSA-2026:98978 (mod_http2-2.0.29-5.el10_3.1)","vendorStatement":{"date":"11 Nov 2026","url":"https://access.redhat.com/security/cve/cve-2026-119618","quote":"The severity for Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 is therefore rated Important rather than Critical."},"addedDate":"2026-11-13"},{"product":"Red Hat Enterprise Linux 8 and earlier","vendor":"Red Hat","type":"linux-distro","notes":"The Hacker News table restates RHEL 6, 7, and 8 as not affected. This is a Red Hat vendor statement, not an inference.","status":"vendor-stated-not-affected","vendorStatement":{"date":"11 Nov 2026","url":"https://access.redhat.com/security/cve/cve-2026-119618","quote":"Versions of mod_http2 prior to 2.0.8 do not contain the affected code, and Red Hat Enterprise Linux 8 and earlier are not affected."},"addedDate":"2026-11-13"},{"product":"Debian unstable (sid) apache2","vendor":"Debian","type":"linux-distro","notes":"Package existence via Trend Micro. Confirm on your mirror before treating a host as patched.","status":"affected","versions":"fixed in apache2 2.4.71-1","vendorStatement":{"date":"12 Nov 2026","url":"https://success.trendmicro.com/en-US/solution/KA-0025062","quote":"Debian unstable has apache2 2.4.71-1."},"addedDate":"2026-11-13"},{"product":"Debian stable apache2","vendor":"Debian","type":"linux-distro","notes":"Debian stable was not checked on a Debian tracker page. The Hacker News 12 Nov table lists bookworm, trixie, and forky as Vulnerable from Debian's security tracker; that is THN's reading, not a Debian vendor statement fetched for this page.","status":"no-statement-yet","vendorStatement":{"date":"Checked 13 Nov 2026","url":"https://success.trendmicro.com/en-US/solution/KA-0025062"},"addedDate":"2026-11-13"},{"product":"Network and security appliances that embed httpd: no statement yet (none found 13 Nov 2026)","vendor":"Various","type":"network-security","notes":"Trend Micro: include reverse proxies, appliances, and third-party products that embed httpd 2.4.55 through 2.4.70. No named appliance vendor statement was found on 13 Nov 2026. This row does not name vendors.","status":"no-statement-yet","vendorStatement":{"date":"Checked 13 Nov 2026","url":"https://success.trendmicro.com/en-US/solution/KA-0025062"},"addedDate":"2026-11-13"}]},"pocs":[{"title":"Public GitHub heap-corruption / crash reproducer (for defenders)","url":"https://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google/","source":"SecurityWeek / Eduard Kovacs","validationStatus":"validated","validationDate":"2026-11-12","listedDate":"2026-11-12","notes":"SecurityWeek (Eduard Kovacs, 12 Nov 2026; checked 13 Nov 2026) says a public GitHub PoC reproduces memory corruption and Apache process crashes without demonstrating remote code execution. Validation is DoS/crash only, not RCE. Not independently validated for RCE. That is SecurityWeek's claim, not a vuln2shell validation. Listed for defenders. This site does not link the PoC repository and does not copy exploit code.","addedDate":"2026-11-13","kind":"dos-crash"}],"_feed":{"page":"https://vuln2shell.com/vulns/apache-httpd-mod-http2-cve-2026-119618","json":"https://vuln2shell.com/vulns/apache-httpd-mod-http2-cve-2026-119618.json","iocsCsv":"https://vuln2shell.com/vulns/apache-httpd-mod-http2-cve-2026-119618/iocs.csv","stix":"https://vuln2shell.com/vulns/apache-httpd-mod-http2-cve-2026-119618/stix.json","badges":{"patch":"Partly patched","itw":"No known ITW","poc":"Public PoC (DoS/crash only)"}}}