Cloud Security Wire
AWS Azure GCP RSS
Multi-Cloud CVE Analysis critical

CVE-2026-119618: Apache HTTP Server mod_http2 RCE, How to Find and Fix It in Cloud Fleets (AWS Commands)

A critical race condition in Apache httpd mod_http2 (2.4.55 to 2.4.70) can lead to remote code execution. Fixed in 2.4.71. How to inventory exposed hosts and images with AWS tooling, plus the HTTP/1.1 workaround. Azure and GCP are covered only as pointers.

By Cloud Security Wire · ·
#CVE-2026-119618#Apache HTTP Server#mod_http2#RCE#patching#EC2#Inspector#container images
Critical Severity

This issue has been assessed as critical severity. Review affected configurations immediately.

Why this matters now

The Apache HTTP Server project released 2.4.71 on 11 November 2026 to fix CVE-2026-119618, which it rates critical: “mod_http2: heap corruption and RCE in assign_headers”. Wiz published an explainer the same day. Apache httpd runs on plenty of cloud VMs and inside many container base images, so the practical problem is finding every copy.

As of 2026-11-13 the situation per the sources we opened: Wiz wrote that at the time of its post “no exploit is available and there are no reports of exploitation in the wild”. No evidence found as of 2026-11-13 of a CISA KEV listing for this CVE in the KEV JSON we pulled that day (catalog version 2026.11.10, released 2026-11-10T19:03Z, which predates the Apache release of 2026-11-11), NVD, or the Apache advisory. A snapshot that predates the CVE cannot rule out later additions, so re-check the live catalog. This is not proof of safety, and a heap-corruption RCE in a widely deployed web server is a likely target for exploit developers (our assessment).

What the sources say

  • Flaw: a race condition (CWE-362, concurrent execution using a shared resource with improper synchronization) in assign_headers() in mod_http2. The CVE record and Apache advisory say it “can lead to RCE”. Wiz adds that a remote, unauthenticated attacker could corrupt heap memory and run commands with the privileges of the web server process (Wiz’s description, single source).
  • Affected: Apache HTTP Server 2.4.55 through 2.4.70. The standalone mod_h2 releases from GitHub, 2.0.8 through 2.0.42, are also affected.
  • Fixed: Apache HTTP Server 2.4.71. Wiz says standalone mod_h2 should be upgraded to a version newer than 2.0.42. Wiz’s affected-versions table words the patched mod_h2 version differently (“0.42 and newer”), so confirm the fixed mod_h2 release against the mod_h2 project before relying on it.
  • Discovery and timeline (Apache advisory): reported by Anthropic’s OSS Scanner (ANT-2026-MAPKT6MZ) on 2026-10-26 and by Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research on 2026-11-03; fixed in the 2.4.x branch and 2.4.71 released on 2026-11-11.
  • Cloud prevalence (Wiz data, single source): 64% of cloud environments have resources running a vulnerable version and 51% have publicly exposed instances. Wiz notes this ignores configuration, so many of these may not have HTTP/2 enabled.

CVSS: who said what

As of 2026-11-13, NVD lists the CVE as “Awaiting Analysis” with no CVSS score. The CNA (the Apache Software Foundation) supplied only a textual severity of “critical” and no CVSS vector in the CVE record we read. Wiz also gave no numeric score. We therefore state no CVSS number. Do not infer one from the word “critical”.

Step 1: find vulnerable hosts

Untested examples to adapt; check each against your tooling.

EC2 with Systems Manager Inventory (lists instances whose collected application inventory includes an httpd package; package names vary by distribution, for example apache2 on Debian-family systems):

aws ssm get-inventory \
  --filters "Key=AWS:Application.Name,Values=httpd,Type=Equal" \
  --query "Entities[].{Instance:Id}" --output table

Then read the version from the instance itself, since inventory freshness varies:

httpd -v        # RHEL-family; use apache2 -v on Debian-family
httpd -M | grep -i http2

Amazon Inspector findings (if Inspector scanning is enabled; the CVE may not appear until your scanner’s vulnerability data includes it, which we did not verify):

aws inspector2 list-findings \
  --filter-criteria '{"vulnerabilityId":[{"comparison":"EQUALS","value":"CVE-2026-119618"}]}' \
  --query "findings[].{Resource:resources[0].id,Severity:severity}" --output table

Container images: rebuild any image that installs httpd or is based on an image that bundles it, then re-scan. Pinning a base image digest hides the fix until you rebuild (our assessment). Azure and GCP equivalents are Defender for Cloud and Artifact Registry scanning; we did not check whether either flags this CVE yet.

Step 2: patch

Upgrade to Apache HTTP Server 2.4.71 or later. Distribution packages often backport fixes without changing the upstream version string, so a “2.4.6x” banner on a distro build is not conclusive in either direction (our general knowledge). The NVD record links vendor trackers (Ubuntu, Red Hat, Gentoo, AlmaLinux, Azure Linux); check yours for the fixed package version rather than comparing numbers.

Step 3: temporary mitigation

If you cannot patch now, Wiz recommends disabling HTTP/2 by restricting protocols to HTTP/1.1, removing h2 and h2c:

# httpd.conf or the relevant VirtualHost
Protocols http/1.1

Then validate and reload:

apachectl configtest && apachectl graceful

Check every VirtualHost, because a more specific Protocols line can override a global one (our general knowledge of Apache configuration). Confirm with curl -sI --http2 -o /dev/null -w '%{http_version}\n' https://your-host/, which should print 1.1. Wiz presents this as a temporary measure; the sources do not say whether other modules are involved, so do not treat it as a full substitute for patching.

Detection and exposure notes

The sources we read publish no indicators of compromise or exploit signatures. Until they do, prioritize internet-facing hosts, and review unexpected httpd child-process crashes, since heap corruption bugs often show up as crashes before reliable exploits exist (our assessment). On cloud hosts, a compromised web server process can reach the instance metadata service; Wiz notes lateral movement and metadata exposure as a risk. Enforcing IMDSv2 and minimal instance role permissions limits what a compromised process can reach, but it does not stop code running on the instance from requesting a token and reading its own credentials (our assessment), so treat role credentials on an exposed host as at risk after any suspected compromise. Example, untested:

aws ec2 modify-instance-metadata-options \
  --instance-id <instance-id> \
  --http-tokens required --http-endpoint enabled

References

← All Analysis Subscribe via RSS