al-ice.ai

The Scanner Reported It Twice: Apache mod_http2 RCE Fixed in 2.4.71 After Independent Anthropic and Google Finds

AI CVEs by al-ice.ai Editorial

On 11 November 2026, the Apache HTTP Server Project released version 2.4.71, fixing a critical race condition in mod_http2 that allows unauthenticated remote code execution. Tracked as CVE-2026-119618, the flaw affects every 2.4.x release from 2.4.55 through 2.4.70 — more than two years of supported versions. What makes the disclosure notable for this site is the finder line: Apache credits Anthropic’s OSS Scanner, which reported the bug on 26 October, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research, who independently reported the same vulnerability on 3 November. Two frontier-lab pipelines converged on the same heap-corrupting race in the world’s most deployed web server within eight days of each other.

A race in assign_headers becomes remote code execution

Apache describes the issue as improper synchronization of shared resources (CWE-362) in mod_http2’s assign_headers() function: concurrent threads mishandle shared state and corrupt server memory, which an attacker can steer toward code execution. The affected surface is precisely bounded — only servers with HTTP/2 enabled are vulnerable; HTTP/1.1-only configurations are not, a point Red Hat emphasizes in its advisory. Standalone mod_h2 releases from GitHub (2.0.8 through 2.0.42) carry the same flaw, and the fix landed upstream as commit 824beab. The 2.4.71 release bundles two further fixes worth noting during the same maintenance window: CVE-2026-106023, an important-severity NULL-pointer dereference in mod_md that crashes child processes, and CVE-2026-109163, a low-severity one-byte stack buffer overwrite in mod_vhost_alias.

Exposure is broad, exploitation is not confirmed

Red Hat scores the vulnerability at CVSS 9.8, noting remote exploitation without authentication to run arbitrary commands and seize the server process. Wiz, which published its own analysis on 11 November, reports that 64% of cloud environments in its data run affected Apache versions and 51% have publicly exposed instances — with the explicit caveat that those figures do not account for server configuration, so they do not equal exploitable installations. On exploit maturity, the picture is early: at the time of Wiz’s write-up there was no available exploit and no observed in-the-wild exploitation. A publicly posted proof of concept on GitHub is described as reproducing memory corruption and process crashes only, not remote code execution. The NVD record for CVE-2026-119618 still shows Awaiting Analysis. That gap between broad exposure and unconfirmed weaponization is exactly the window in which patching pays off most.

What to actually do

  1. Upgrade to Apache HTTP Server 2.4.71 or a vendor-supplied package now on every host with mod_http2 loaded — the affected range spans 2.4.55 through 2.4.70, and standalone mod_h2 users need 2.0.43 or later.
  2. If you cannot patch immediately, disable HTTP/2 as a temporary mitigation: removing the vulnerable module from the request path prevents exploitation at the cost of protocol features.
  3. Inventory before you assume safety: HTTP/2 is frequently enabled by default in modern distro packages and behind TLS-terminating defaults, so check loaded modules rather than relying on what you think the config says.
  4. Watch child-process crash telemetry on unpatched hosts: heap corruption of this class tends to crash workers before it yields control, so unexpected child exits on HTTP/2 endpoints deserve triage, not shrugs.
  5. Treat scanner-found disclosure as the new normal: frontier-lab OSS scanners are now independently converging on the same critical bugs in foundational software — assume the next mod_http2-class flaw is already in someone’s queue.

Read with the ActiveMQ RCE that Claude found in ten minutes, this disclosure extends the pattern from message brokers to the web tier itself: AI-driven discovery pipelines are now producing critical findings in decades-old infrastructure. And as the HTTP/2 Bomb episode showed, the HTTP/2 attack surface keeps rewarding anyone — human or model — who looks at it closely.

Our verification was read-only. We read the Apache HTTP Server 2.4 vulnerabilities page first-hand in full: CVE-2026-119618 critical rating, CWE-362 in assign_headers, the 2.4.55-through-2.4.70 affected range, mod_h2 2.0.8-through-2.0.42 scope, both finder credits with report dates (Anthropic 26 October 2026 as ANT-2026-MAPKT6MZ, Google 3 November 2026), fix commit 824beab, the 2.4.71 release dated 11 November 2026, and both bundled sibling CVEs. We checked the NVD record for CVE-2026-119618 first-hand (Awaiting Analysis, with oss-security, Red Hat, Wiz, and distro references). SecurityWeek’s 12 November report (Eduard Kovacs) is carried as reported for the Red Hat 9.8 score and unauthenticated-remote characterization, the Wiz 64%/51% exposure figures with their configuration caveat, the no-exploit and no-in-the-wild status at publication, and the crash-only PoC description. We ran no server, tested no exploit, and contacted no vendor. Brave Search was used for discovery only.

Sources: