Apache Patches Critical HTTP Server RCE Found by Anthropic, Google
Apache has patched a critical HTTP Server vulnerability that could allow unauthenticated remote code execution (RCE), following independent discoveries by Anthropic and Google researchers.
Tracked as CVE-2026-119618, the flaw affects Apache HTTP Server versions 2.4.55 through 2.4.70. The issue was addressed on November 11 with the release of version 2.4.71. It resides in mod_http2, the module responsible for handling HTTP/2 traffic.
The vulnerability involves a race condition in which multiple threads improperly access shared resources, potentially corrupting server memory.
According to Red Hat, an attacker could exploit the issue remotely without authentication to execute arbitrary commands and gain control of the server process. Red Hat assigned the vulnerability a CVSS score of 9.8 and explained that “only servers that have HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable.”
Apache creditedAnthropic’s OSS Scanner with reporting the flaw on October 26. Anthony Weems and...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
