Apache’s critical HTTP/2 flaw CVE-2026-119618 now has a public proof-of-concept, but the code demonstrates heap corruption and server-process crashes rather than a working remote-code-execution chain. The Apache Software Foundation released HTTP Server 2.4.71 on November 11 to fix the issue in mod_http2, which the project says can lead to remote code execution. A new public GitHub proof-of-concept reproduces the race in Apache 2.4.70 and reports no corruption in 2.4.71 under the same test.
The flaw is a concurrent-execution bug in the assign_headers() function. It affects Apache HTTP Server versions 2.4.55 through 2.4.70 when HTTP/2 is enabled, as well as standalone mod_h2 releases 2.0.8 through 2.0.42. The fixes are included in HTTP Server 2.4.71 and mod_h2 2.0.43, according to the Apache security advisory. The public PoC uses a body-less HTTP/2 request with a Content-Type header, no Content-Length header and a full request-header table to trigger the race.
The GitHub repository’s containerized tests report heap corruption, AddressSanitizer crashes and ThreadSanitizer races in the affected 2.4.70 build. The same tests did not reproduce the corruption in 2.4.71. The PoC therefore demonstrates the memory-corruption condition, but it does not show an attacker turning that condition into code execution.
Red Hat’s security analysis assigns the upstream issue a CVSS score of 9.8 and says public research has demonstrated a reliable exploit against a default-configured server with mod_http2 enabled. Red Hat rates its RHEL 9 and RHEL 10 packages Important because their builds make exploitation more complex. In a November 11 analysis, Wiz said no exploit was available and it had seen no reports of attacks in the wild at that time. A November 12 technical update described the new public PoC as a crash demonstration rather than an RCE exploit and reported no confirmed in-the-wild attacks.
Apache HTTP Server 2.4.71 also fixes CVE-2026-106023, an important mod_md NULL-pointer issue that can crash a child process, and CVE-2026-109163, a low-severity stack overwrite in mod_vhost_alias.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Apache HTTP/2 Flaw Gets Public Heap-Corruption PoC
