Free Apache HTTP/2 vulnerability scanner - detect CVE-2026-119618 RCE

1. Method: the scanner connects to ports 443, 8443, and 80, asks for HTTP/2 through ALPN on TLS ports and through an h2c upgrade on plain HTTP ports, and reads the Apache version from the Server header.
2. Match condition: the target reports Apache 2.4.55 through 2.4.70 and negotiates HTTP/2.
3. Limitations:
   • RHEL 9 and 10, AlmaLinux, Fedora, and Azure Linux ship the fix as a backport, so a patched server can still report an older version. Check the installed mod_http2 package on the host.
   • If the server hides its version (ServerTokens Prod), the scanner can't conclude.
   • If a CDN or reverse proxy handles HTTP/2 in front of Apache, the scanner sees the proxy, and the result describes the proxy's protocol support.
   • Protocols can differ per virtual host. The scanner tests only the hostname you enter.
4. Safety: the check sends only standard HTTP requests and never sends the request that triggers the bug.
5. CVE coverage: CVE-2026-119618 only. Apache 2.4.71 also fixes CVE-2026-106023 and CVE-2026-109163, which this scanner doesn't check.
6. Evidence and confidence: each finding includes the version string, the negotiated protocol, and the port, and carries a Certain level of confidence.

Technical details

CVE-2026-119618 sits in mod_http2, the Apache HTTP Server module that implements HTTP/2, and in the standalone mod_h2 project it came from. Apache disclosed it on November 11, 2026, with the fix in httpd 2.4.71. Anthropic's OSS Scanner and Google Cloud Vulnerability Research found it independently.

When an HTTP/2 request has no body, a Content-Type header, and no Content-Length, a worker thread adds a Content-Length: 0 header to a table that draws memory from the connection's shared, lock-free allocator, racing the connection thread for the same memory. The fix moves that write into memory the worker owns.

What an attacker can do by exploiting CVE-2026-119618

• Corrupt the heap of an Apache child/worker process with HTTP/2 requests, without credentials
• Potentially run code with the web server's privileges (Red Hat; public code shows the corruption, not code execution, as of November 12, 2026)

Any product that bundles Apache 2.4.55 to 2.4.70 with HTTP/2 inherits the flaw: container images built before November 11, appliances, and control panels that ship their own Apache build. Check those with the vendor.

Potential business impact: what this can mean for your organization

Public reproduction work already crashes Apache child processes, so availability is the most immediate risk for vulnerable Apache servers: dropped requests and failed checkouts, logins, or API calls each time a child process crashes, with repeated triggers degrading service until you patch or turn off HTTP/2.

If an attacker turns the memory corruption into code execution, here are a couple of scenarios to prepare for:

• A data breach that starts reporting clocks: 72 hours under GDPR for personal data, and a 24-hour early warning under NIS2 for organizations in scope
• Content you didn't publish served from your domain, which can get your site blocklisted by browsers and erode customer trust
• Recovery costs: rebuilding hosts, rotating every credential the server could read, and reviewing logs across the exposure window
• Compliance findings: PCI DSS v4.0 expects critical security patches within one month of release (Requirement 6.3.3)

For hosting providers and SaaS vendors, one compromised Apache server can potentially affect every customer site or tenant it serves.

Apache HTTP Server versions vulnerable to CVE-2026-119618

Apache HTTP Server 2.4.55 through 2.4.70 is vulnerable when HTTP/2 is enabled, as is standalone mod_h2 2.0.8 through 2.0.42.

Two notes to consider when assessing your servers:

• distribution packages often carry the fix under an older version number, so check the package changelog, not only the version string.
• Embedded copies (appliances, control panels, bundled binaries, container images) need their own inventory.

CVE-2026-119618 severity score unpacked

• Apache: critical (textual rating, no CVSS score published)
• Red Hat: CVSS v3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), overall Critical; RHEL 9 and 10 packages rated Important because their builds give each HTTP/2 stream its own allocator
• NVD: no score as of November 12, 2026

Scoring factors:

• No authentication required
• No user interaction required
• Reachable over the network, but only on servers that negotiate HTTP/2

What slows exploitation: the trigger needs a narrow request shape and timing window, per Helix ML's lab, and RHEL's allocator design raises the bar further.

The TL;DR for leadership: any internet-facing Apache 2.4.55 to 2.4.70 server that speaks HTTP/2 is exposed to an unauthenticated flaw with public crash reproduction and credible code execution, and upgrading or turning off HTTP/2 closes it.

CVE-2026-119618 disclosure timeline

1. Complete fix: upgrade to Apache HTTP Server 2.4.71 (Apache advisory).
2. Upgrade path:
   • Upstream builds: install 2.4.71.
   • RHEL, AlmaLinux, Fedora: install the patched mod_http2 package from your vendor's errata.
   • Debian and Ubuntu: watch your security tracker; Debian stable had no fix as of November 12.
   • Standalone mod_h2 builds: switch to the mod_http2 module bundled with httpd 2.4.71.
   • Containers: rebuild any image built before November 11 on a fixed base image.
   • Appliances and control panels: ask the vendor for their fixed build.
3. Verification: run apachectl -v (or httpd -v) and apachectl -M | grep http2 on every host, check the package (rpm -q mod_http2 or dpkg -l apache2), and confirm the protocol with curl -sI --http2 https://your-host/. Then rescan with this scanner.
4. Temporary control (CVE-2026-119618 only): set Protocols http/1.1 in every config file and every VirtualHost block, then reload Apache. Clients fall back to HTTP/1.1. This doesn't address CVE-2026-106023 or CVE-2026-109163.
5. Monitoring option: watch the Apache error log for child process crashes (for example, AH00052: child pid ... exit signal Segmentation fault) and assertion failures in mod_http2. A spike can signal trigger attempts.
6. Closing note: the Protocols change removes the path to this bug while it stays in place. Upgrading removes the bug.

Our Network Vulnerability Scanner is a well-rounded tool for all your network security assessments.

It combines multiple engines and fine-tuned scan settings that surface more than 17,500 vulnerabilities, misconfigurations, and outdated services. Each scan automatically updates your attack surface.