Tech

Apache patches critical HTTP/2 pre-auth RCE flaw affecting mod_http2

Key Points

CVE-2026-119618 is a critical pre-auth remote code execution flaw in Apache HTTP Server’s mod_http2 (HTTP/2) module.
Affected Apache versions are 2.4.55 through 2.4.70; the fix is in Apache HTTP Server 2.4.71 (and standalone mod_h2 2.0.43).
Exploitation is described as unauthenticated and pre-auth, requiring HTTP/2 to be enabled in the server configuration.
HTTP/2 enabling is controlled by the Protocols directive (h2 for TLS, h2c for plain TCP) and may be set server-wide and/or per virtual host.
Coverage notes differing claims about exploit availability and whether exploitation in the wild has been reported, citing security firm commentary.

Where coverage differs

The outlets largely agree on the core facts: CVE-2026-119618 affects Apache’s mod_http2 HTTP/2 implementation, is pre-authunauthenticated, applies only when HTTP/2 is enabled, and is fixed in 2.4.71. Differences are mainly in what each emphasizes and how much technical or operational detail is provided. SecurityWeek specifically attributes the finding to Anthropic and Google, while Dev.to provides a deeper explanation of the race condition and an example of the request shape involved. Slashdot and The Hacker News both mention a debate around exploit availability—Slashdot adds that one vendor assessment notes public research demonstrated a reliable exploit, while Wiz later said no exploit was available and no wild exploitation had been reported. Dev.to adds percentages and lab/PoC references, while the other summaries focus more on patching and configuration. Version and scope details are consistent across sources, including the need to check server-wide and per-virtual-host Protocols settings.

See what each outlet emphasised ↓

Cross-checked across outlets

4 sources

Compare coverage

15 hours ago

2 views

Share this story

Facebook

Apache HTTP Server is patching a critical vulnerability in its mod_http2 HTTP/2 module that can allow unauthenticated attackers to achieve remote code execution. The issue is tracked as CVE-2026-119618 and is fixed in Apache HTTP Server version 2.4.71, with standalone mod_h2 also receiving a corresponding update.

Reporting across outlets says the flaw applies only when HTTP/2 is enabled (via the Protocols directive using h2/h2c) and affects specific Apache versions between 2.4.55 and 2.4.70. Slashdot and The Hacker News also cite differing assessments regarding exploit availability, noting that one security firm later said no exploit was available and that no exploitation in the wild had been reported. SecurityWeek frames the underlying cause as an HTTP/2 “race condition” and attributes discovery to Anthropic and Google.

Other coverage adds implementation detail on how the bug works, describing a race that can corrupt heap memory and form the basis for code execution. Several sources also stress the importance of checking both server-wide and per-virtual-host Protocols settings, plus guidance to upgrade or disable HTTP/2 if patching is not possible.

This summary is generated automatically from the reporting of the outlets listed on this page. Follow their links for the full coverage.

Photos from the outlets' coverage

How Outlets Covered This Story

BLE

Bleeping Computer

Independent

Apache HTTP Server patches critical HTTP/2 remote code execution flaw

Bleeping Computer leads with the existence of a critical HTTP/2 flaw and states it can be exploited pre-auth for remote code execution, focusing on the need to patch.

2 hours ago

SLA

Slashdot

Independent

Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

Slashdot emphasizes actionable details: CVE identifier, exact affected and fixed version ranges, and the uncertainty around public exploit availability, plus configuration guidance for Protocols settings.

4 hours ago

SEC

SecurityWeek

Independent

Apache Patches Critical HTTP Server RCE Found by Anthropic, Google

SecurityWeek foregrounds discovery attribution, linking the patched RCE to work by Anthropic and Google, and describes the root issue as a mod_http2 race condition.

6 hours ago

DEV

Dev.to

Independent

CVE-2026-119618: Apache HTTP/2 Pre-Auth RCE — What the Race Condition Actually Does

Dev.to focuses on technical mechanism, explaining the specific request shape and threading/race behavior that leads to heap corruption, alongside upgrade and short-term mitigation steps.

12 hours ago

THE

The Hacker News

Independent

Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

The Hacker News highlights the unauthenticated remote code execution impact, repeats key versioning (affected 2.4.55–2.4.70, fixed 2.4.71), and frames risk through the prerequisite of HTTP/2 being enabled.

16 hours ago

25 original Xbox games become available on PC for Xbox’s 25th anniversary

Microsoft is rolling out access to 25 original Xbox games on Windows PCs as part of Xbox’s 25th anniversary. Xbox Wire s...

2 sources 15 minutes ago

Tech

ConnectWise probes ScreenConnect breaches linked to rogue extensions and malware campaigns

ConnectWise is investigating reported breaches involving its ScreenConnect remote-access software after researchers and...

5 sources 22 hours ago

Tech

Microsoft 365 outage disrupts Outlook and Teams; company says it is investigating server issues

Microsoft has a widespread outage affecting users’ access to Microsoft 365 services, including Outlook and Teams, with m...

37 sources 3 hours ago