Apache has closed a critical race condition in its HTTP/2 module that lets an unauthenticated attacker corrupt the server's heap and execute code on it. The fix is in Apache HTTP Server 2.4.71, released on 11 November 2026, and is tracked as CVE-2026-119618.

What happened

The defect sits in assign_headers() inside mod_http2. When a request arrives with a Content-Type header and no body, the worker writes a synthesised Content-Length value into the connection's shared header table instead of request-private memory. Two threads can then take ownership of the same allocation, the httpd child process heap is corrupted, and that corruption can be steered into code execution as the web server user.

No credentials and no user interaction are required: the attacker only has to send the request. Apache publishes the issue as critical, with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). The project advisory lists no workaround, and the flaw is not known to be exploited in the wild or listed in CISA's KEV catalog at the time of writing.

Who is affected

Apache HTTP Server 2.4.55 through 2.4.70, and standalone mod_h2 builds 2.0.8 through 2.0.42, wherever HTTP/2 is switched on.

• Any httpd instance with h2 or h2c in the Protocols directive, whether set server-wide or in a single virtual host.
• Shared hosting and cPanel stacks that front WordPress or other PHP sites with HTTP/2 negotiated.
• Reverse proxies and load balancers that forward HTTP/2 to a vulnerable origin behind them.
• Container images built from a base layer that still carries 2.4.55 to 2.4.70.

Servers pinned to Protocols http/1.1 never reach the vulnerable code path.

What to do now

Upgrade to Apache HTTP Server 2.4.71 or the fixed package for your distribution, then confirm the installed package version rather than trusting the httpd banner.

• Inventory every httpd instance, including containers, appliances and vendor stacks you did not build yourself.
• Check the Protocols directive server-wide and in every virtual host; one virtual host that re-enables h2 restores the whole exposure.
• If you cannot patch this week, remove h2 and h2c from Protocols and reload, accepting the HTTP/1.1 performance cost.
• After patching, hunt for unexpected httpd child crashes and outbound connections owned by the httpd user.

What this means for South African businesses

Most South African SMEs cannot name the web server in front of their site or booking system, because it arrived bundled with a hosting plan. That is precisely the population this flaw suits: a public HTTPS endpoint, HTTP/2 on by default in most 2026 builds, and nobody watching for httpd child crashes. If your site runs on an unmanaged shared host, get the Apache and mod_http2 versions from that host in writing, and treat a vague answer as a finding in itself. A flaw that needs no credentials and no interaction on the most widely deployed web server will be scanned for quickly, so this belongs in this week's change window, not next quarter's.

Source: Apache HTTP Server 2.4 security vulnerabilities.

Also on the blog

• Node.js CVE-2026-123864: HTTPS flaw leaks TLS keys, patch to 22.23.5, 24.22.3 or 26.13.1
• Stats SA job-seeker data sells for R34,000 as SA breach reports pass 8,000

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.