BigFix Patch content for CVE-2026-119618 shipped on 11 Nov 2026, the same day Red Hat published its mod_http2 security updates. If you run Apache HTTP Server with HTTP/2 enabled, this is a remediate-now item.
What the vulnerability is
CVE-2026-119618 is a race condition (CWE-362) in the assign_headers() function of Apache HTTP Server's mod_http2 module. Concurrent HTTP/2 requests can corrupt the heap of an httpd child process, which Apache states can lead to remote code execution. Apache rates it Critical. Public research has demonstrated reliable exploitation against a default-configured server with mod_http2 enabled; as of 12 Nov 2026 it is not listed in CISA KEV and no in-the-wild exploitation has been confirmed. The flaw was reported independently by Anthropic's OSS Scanner (26 Oct 2026) and Google Cloud Vulnerability Research (3 Nov 2026).
| Property | Detail |
|---|---|
| Affected (upstream) | Apache HTTP Server 2.4.55 through 2.4.70; standalone mod_h2 2.0.8 through 2.0.42 |
| Fixed (upstream) | Apache HTTP Server 2.4.71, released 11 Nov 2026 |
| Exposure condition | Only servers serving HTTP/2 reach the vulnerable code. HTTP/1.1-only servers are not affected. |
| Workaround | None published by Apache. Patching is the remediation. |
BigFix content available
The following Fixlets are live in the Patches for RHEL, Updates for Linux Applications Middleware, Patches for Amazon Linux sites:
| Fixlet ID | Advisory | Platform |
|---|---|---|
| 2641141 | ALAS2-2026-4114 - Httpd Security update - Amazon linux 2 x86_64 | Patches for Amazon Linux 2 |
| 2641141 | ALAS2-2026-4114 - Httpd Security update - Amazon linux 2 aarch64 | Patches for Amazon Linux 2 Graviton |
| 322634581 | ALAS2023-2026-3458 - Httpd Security update - Amazon linux 2023 x86_64 | Patches for Amazon Linux 2023 |
| 322634581 | ALAS2023-2026-3458 - Httpd Security update - Amazon linux 2023 aarch64 | Patches for Amazon Linux 2023 Graviton |
| 66200101 | DSA-6620-1 - Apache2 Security Update - Debian 13 (amd64) | Patches for Debian 13 |
| 26989781 | RHSA-2026:98978 - Mod_http2 Security Update - Red Hat Enterprise Linux 10 (x86_64) | Patches for RHEL 10 |
| 26989811 | RHSA-2026:98981 - Mod_http2 Security Update - Red Hat Enterprise Linux 9 (x86_64) | Patches for RHEL 9 |
| 26989541 | RHSA-2026:98954 - Mod_http2 Security Update - Red Hat Enterprise Linux Extended Update Support 9.6 (x86_64) | Patches for RHEL 9 Extended Support |
| 26989821 | RHSA-2026:98982 - Mod_http2 Security Update - Red Hat Enterprise Linux Extended Update Support 9.8 (x86_64) | Patches for RHEL 9 Extended Support |
| 26989811 | RHSA-2026:98981 - Mod_http2 Security Update - Red Hat Enterprise Linux 9 (s390x) | Patches for RHEL 9 on System z |
| 90900101 | USN-9090-1 - Apache Http Server Vulnerabilities - Ubuntu 22.04 (amd64) | Patches for Ubuntu 2204 |
| 90900101 | USN-9090-1 - Apache Http Server Vulnerabilities - Ubuntu 26.04 (amd64) | Patches for Ubuntu 2604 |
| 90900101 | USN-9090-1 - Apache Http Server Vulnerabilities - Ubuntu Pro 18.04 (amd64) | Patches for Ubuntu Pro 1804 |
| 90900101 | USN-9090-1 - Apache Http Server Vulnerabilities - Ubuntu Pro 20.04 (amd64) | Patches for Ubuntu Pro 2004 |
| 46005 | Update: Apache HTTP Server v2.4.71 (Scanner based) - AIX | Updates for Linux Applications Middleware |
| 45005 | Update: Apache HTTP Server v2.4.71 (Scanner based) - RHEL | Updates for Linux Applications Middleware |
| 44005 | Update: Apache HTTP Server v2.4.71 (Scanner based) - Ubuntu | Updates for Linux Applications Middleware |
| 42005 | Update: Apache HTTP Server v2.4.71 (Scanner based) - Solaris | Updates for Linux Applications Middleware |
| 43005 | Update: Apache HTTP Server v2.4.71 (Scanner based) - Windows (x64) | Updates for Windows Applications Middleware |
Content for other distributions will follow as each vendor releases fixed packages. Others had not published fixed stable packages as of 12 Nov 2026.
Rapid-Release Detection-Only Scanner Updated
See the notice below about the availability of a full-system-scan detection hosted on our public github.com site. This scan combines recent detections for Apache mod_http2, php, and brotli into a single task per operating system. This may be useful in detecting non-standard Apache installs (those embedded in other applications or otherwise installed outside of the system's package manager.)
How to remediate with BigFix
-
Find exposure. In the BigFix console, search the Patches for RHEL sites for CVE-2026-119618 or Mod_http2. The Fixlets above are relevant only on endpoints where the vulnerable mod_http2 RPM is installed, so the relevance count is your exposed-device count.
-
Confirm HTTP/2 is in play. Endpoints with mod_http2 installed but HTTP/2 disabled (no Protocols h2) are not reachable via the known attack path, but still carry the vulnerable package. Patch them anyway.
-
Deploy. Take action on each Fixlet, or add them to a Patch Policy or baseline so EUS and new RHEL 10 hosts are covered in one pass.
-
Verify. Fixlets go non-relevant once the fixed mod_http2 RPM is installed and httpd has restarted. Use the Patch dashboard or a Web Report filtered on the five Fixlet IDs to track closure.
If you also run Apache from source or from a vendor appliance, upgrade to httpd 2.4.71 directly.
Thanks
Sulabh