CVE-2026-119618: Apache HTTP/2 Pre-Auth RCE - What the Race Condition Actually Does

What Happens

There is a CVSS 9.8 pre-authentication remote code execution vulnerability in Apache HTTP Server's mod_http2 module. It was fixed on 11 November 2026 in version 2.4.71.

If you run Apache with HTTP/2 enabled and you have not patched, this post is for you.

mod_http2 is designed so that worker threads never touch the connection's shared allocator - each worker gets a private one. assign_headers() breaks that rule for a specific request shape: body-less, with Content-Type and no Content-Length, when the request header table is full.

The worker writes a synthesised Content-Length: 0 into the shared stream table. That write races with the connection thread on a lock-free free list. Two threads pop the same node. Heap corrupts.

The process ends up with double-owned memory, and that's the primitive the exploit turns into code execution. No credentials. No user interaction. The attacker sends an HTTP/2 request.

Who's Affected

Apache HTTP Server 2.4.55 through 2.4.70, and standalone mod_h2 2.0.8 through 2.0.42 - but only if HTTP/2 is enabled. That's the h2 or h2c token in the Protocols directive. The directive can be set server-wide or per virtual host, so check both.

Scale Wiz reports 64% of cloud environments have resources on a vulnerable version, and 51% have publicly exposed instances.

A containerised differential lab, ThreadSanitizer evidence, and a stdlib HTTP/2 PoC are already on GitHub under the CVE identifier.

Fix

Upgrade to Apache HTTP Server 2.4.71 or mod_h2 2.0.43.

• RHEL 9: mod_http2-2.0.26-7.el9_9.1
• RHEL 10: mod_http2-2.0.29-5.el10_3.1

Container images built before 11 November need a rebuild.

If you can't patch today:

Protocols http/1.1

in every config file and every virtual host block.

Full write-up with hunt guidance and Red Hat vs upstream rating breakdown: https://threataft.com/articles/cve-2026-119618-apache-mod-http2-race-condition-rce