{"id":68270,"date":"2026-11-12T14:20:09","date_gmt":"2026-11-12T21:20:09","guid":{"rendered":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-119618-apache-http2-rce-detection-with-sn1per\/"},"modified":"2026-11-12T14:20:09","modified_gmt":"2026-11-12T21:20:09","slug":"cve-2026-119618-apache-http2-rce-detection-with-sn1per","status":"publish","type":"post","link":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-119618-apache-http2-rce-detection-with-sn1per\/","title":{"rendered":"CVE-2026-119618: Pre-Auth RCE in Apache HTTP Server mod_http2 – Advisory + Nuclei Detection"},"content":{"rendered":"

On 11 November 2026 the Apache Software Foundation released httpd 2.4.71 and published CVE-2026-119618, a race condition in mod_http2<\/code> that corrupts heap memory and can lead to unauthenticated remote code execution. The ASF rates it Critical<\/strong>. Red Hat scores it 9.8<\/strong>. Apache httpd runs on a very large share of the internet-facing web, so within a day the CVE ID was already a search entity.<\/p>\n

Most of the coverage published so far repeats the same five lines from the advisory. This post covers the parts that actually decide what you do on Monday morning: the precondition that separates an emergency from a patch-gap, the three different ways your distribution will lie to a version scanner about whether you are patched, the second CVE in the same release that hits a much wider version range, and two free Nuclei templates that find affected hosts without ever touching the bug.<\/p>\n

One rule before anything else: do not try to trigger this.<\/strong> It is a concurrency flaw that corrupts the heap. A failed attempt can crash worker processes on a live server, and a successful one is an intrusion. Every check in this post is a banner read or an ordinary protocol negotiation.<\/p>\n

What CVE-2026-119618 actually is<\/h2>\n

The ASF description is short:<\/p>\n

\n

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server’s mod_http2 in assign_headers() can lead to RCE.<\/p>\n<\/blockquote>\n

Red Hat’s analysis adds the mechanism. HTTP\/2 lets one client multiplex many requests over a single connection, and mod_http2<\/code> services those concurrent streams with multiple threads. Because of a thread-safety flaw, a worker thread can write into memory owned by the connection thread through a shared, lock-free allocator. That is the corruption primitive. No credentials are required to reach it.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Field<\/th>\nValue<\/th>\n<\/tr>\n<\/thead>\n
CVE<\/td>\nCVE-2026-119618<\/td>\n<\/tr>\n
Component<\/td>\nmod_http2<\/code>, function assign_headers()<\/code><\/td>\n<\/tr>\n
Class<\/td>\nCWE-362, race condition (Red Hat files it as CWE-20)<\/td>\n<\/tr>\n
Affected<\/td>\nApache HTTP Server 2.4.55 through 2.4.70<\/strong>, inclusive<\/td>\n<\/tr>\n
Also affected<\/td>\nStandalone mod_h2<\/code> from GitHub, 2.0.8 through 2.0.42<\/strong><\/td>\n<\/tr>\n
Fixed in<\/td>\nApache HTTP Server 2.4.71<\/strong>, commit 824beab<\/code>, released 2026-11-11<\/td>\n<\/tr>\n
Precondition<\/td>\nHTTP\/2 enabled – Protocols h2<\/code> or h2c<\/code><\/td>\n<\/tr>\n
Reported<\/td>\n2026-10-26 (Anthropic), 2026-11-03 (Google Cloud Vulnerability Research)<\/td>\n<\/tr>\n
In CISA KEV<\/td>\nNo, as of catalog 2026.11.10<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The credit line is worth reading twice. The ASF names Anthropic’s OSS Scanner<\/strong>, as internal vulnerability ID ANT-2026-MAPKT6MZ<\/code>, reporting on 26 October, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research<\/strong> reporting independently on 3 November. An automated AI code scanner found a critical pre-auth RCE in one of the most heavily reviewed C codebases on the internet, eight days before a top-tier human research team found the same bug. That is the real story of this CVE, and almost nobody is telling it.<\/p>\n

2.4.71 is a three-CVE release, and the second one has a wider range<\/h2>\n

Every article so far treats 2.4.71 as the CVE-2026-119618 release. It is not. The ASF shipped three fixes:<\/p>\n\n\n\n\n\n\n\n
CVE<\/th>\nSeverity (ASF)<\/th>\nComponent<\/th>\nAffected range<\/th>\n<\/tr>\n<\/thead>\n
CVE-2026-119618<\/strong><\/td>\nCritical<\/td>\nmod_http2<\/code> heap corruption and RCE<\/td>\n2.4.55 – 2.4.70<\/td>\n<\/tr>\n
CVE-2026-106023<\/strong><\/td>\nImportant<\/td>\nmod_md<\/code> NULL pointer dereference, child crash<\/td>\n2.4.30 – 2.4.70<\/strong><\/td>\n<\/tr>\n
CVE-2026-109163<\/td>\nLow<\/td>\nmod_vhost_alias<\/code> 1 byte stack overwrite<\/td>\n2.4.69 – 2.4.70<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Look at the mod_md range. It starts at 2.4.30<\/strong>, twenty-five releases earlier than the mod_http2 bug. This matters because of the single most common reaction to this advisory, which goes: we only serve HTTP\/1.1, so we are not affected, so we can defer the upgrade<\/em>. That reasoning is correct for CVE-2026-119618 and wrong for the release. A 2.4.52 host with HTTP\/2 switched off is out of range for the RCE and squarely inside the range for the mod_md crash.<\/p>\n

mod_md<\/code> is Apache’s built-in ACME client, the one that issues and renews Let’s Encrypt certificates through the MDomain<\/code> directive. If you use it, a remote request can dereference a NULL pointer and take down a child process. If you do not use it, unload it.<\/p>\n

We ship a template for this one too, precisely because it catches the hosts the headline template is designed to ignore.<\/p>\n

The scoring is a mess, and you should know why<\/h2>\n

There is no authoritative number for CVE-2026-119618. At the time of writing:<\/p>\n