A critical Apache HTTP/2 flaw found by Anthropic's scanner and by Google, fixed on November 11

Apache HTTP Server 2.4.71, released on November 11, 2026, fixes CVE-2026-119618, a critical remote code execution flaw in mod_http2, reported on October 26 by Anthropic's analysis tool and on November 3 by Google Cloud. Wiz finds that 64 percent of cloud environments have affected resources.

In short

• On November 11, 2026, Apache releases version 2.4.71 and fixes CVE-2026-119618, rated critical: poorly synchronized concurrency in assign_headers() of the mod_http2 module corrupts the heap and allows remote code execution. Affected: versions 2.4.55 to 2.4.70.
• Found by "Anthropic's OSS Scanner" (reported October 26) and, independently, by two Google Cloud researchers (November 3). Sixteen days between the first report and the fix.
• Wiz (November 12): 64 percent of cloud environments have vulnerable resources, 51 percent have publicly exposed instances; no public exploit or observed exploitation at that point.
• To do: move to 2.4.71, or disable HTTP/2 in the meantime (Protocols http/1.1).

← All the watch