A critical vulnerability in Apache HTTP Server's HTTP/2 handling could allow a remote attacker to execute code on affected systems without authentication, according to cloud security company Wiz. The flaw, tracked as CVE-2026-119618, affects the `mod_http2` module and has been addressed in Apache HTTP Server 2.4.71.
The issue is a race condition in the module's `assign_headers()` function. Concurrent threads can handle shared resources without adequate synchronization, creating an opportunity for heap memory corruption. Wiz said an attacker able to trigger that corruption could potentially run arbitrary commands with the privileges assigned to the web server process.
That makes internet-facing servers a particular concern. A compromised Apache instance could provide an initial foothold in a cloud environment, and the consequences would depend on how the server is configured and what other resources its process can reach. Containerized or virtualized deployments do not automatically eliminate the risk if a vulnerable service is exposed.
Wiz said its observations found resources affected by the vulnerability in 64% of cloud environments and publicly exposed instances in 51%. The company cautioned that those figures do not account for individual configuration, so they should not be read as measurements of confirmed exploitable systems. A deployment must use the affected HTTP/2 functionality and fall within the vulnerable version range to be exposed to this specific path.
The recommended response is to upgrade Apache HTTP Server to version 2.4.71 or later. Administrators who maintain a standalone `mod_h2` build should move beyond version 2.0.42. Where an immediate upgrade is operationally impossible, Wiz recommends temporarily disabling HTTP/2 by removing the `h2` and `h2c` protocol options and limiting the service to HTTP/1.1 until the fix can be installed.
The vulnerability was independently discovered by Anthropic and Google Cloud's Vulnerability Research Team, Wiz reported. At the time of the advisory, no public exploit was available and there were no reported cases of active exploitation. That absence does not reduce the need to patch: disclosure gives defenders a clear remediation path, but it can also focus attention on the affected code.
Because the flaw sits in protocol handling rather than application code, teams should check infrastructure inventories and base images as well as directly managed web servers. Systems created from older templates may remain vulnerable even when newly deployed, making version verification more useful than relying on installation dates. Any temporary HTTP/2 shutdown should also be documented so the protocol can be restored after the corrected software is installed and tested.
Security teams should inventory Apache installations, identify which ones expose HTTP/2, confirm their exact versions and prioritize public-facing systems. They should also review normal incident-response controls, including least-privilege service accounts and monitoring for unusual processes launched by the web server. Those measures limit impact but are not substitutes for installing the corrected release.
