Apache HTTP Server RCE Flaw Hits 64% of Cloud Environments

What is CVE-2026-119618?

It's a synchronization bug in mod_http2's assign_headers() function. Under concurrent load, threads share resources without proper locking, letting an attacker trigger heap corruption.

The flaw was discovered independently by Anthropic and Google Cloud's Vulnerability Research Team, which gives you a sense of how seriously the industry is treating it. The bug lives in the HTTP/2 module that many Apache deployments enable by default for performance.

In plain terms: send the right sequence of HTTP/2 requests at the right moment, and you can scramble the server's memory. From there, an attacker can potentially run commands with the web server's privileges. No authentication required.

The good news, such as it is: as of Wiz's publication, there is no public exploit and no reports of exploitation in the wild. The bad news is that the window between disclosure and exploitation is usually short.

CVE-2026-119618 at a glance

How exposed is the web?

Wiz's telemetry puts the numbers in stark terms.

According to Wiz data, 64% of cloud environments have resources vulnerable to CVE-2026-119618, and 51% have publicly exposed instances. Those figures don't account for configuration, so the real attack surface may be smaller, but it's still a huge share of the internet's plumbing.

Apache HTTP Server has been a backbone of the web for decades. A flaw that touches HTTP/2, the protocol most modern browsers prefer, reaches far beyond hobbyist setups. It's in enterprise APIs, microservice meshes, and container images that were built months ago and never rebuilt.

In cloud environments, a compromised Apache instance can be a launchpad for lateral movement, exposing adjacent microservices or metadata endpoints. That's the scenario security teams lose sleep over.

How to fix it: patch or disable HTTP/2

The fix is straightforward, but it requires action.

Upgrade to Apache HTTP Server 2.4.71 or later. That release addresses the race condition in assign_headers(). If you manage standalone mod_h2 builds from GitHub, upgrade the module to a version newer than 2.0.42.

If you can't patch immediately, disable HTTP/2. In your httpd.conf (or equivalent), remove h2 and h2c from the active protocols, forcing HTTP/1.1. It's a performance hit, but it closes the attack vector.

Wiz customers can use a pre-built query in the Wiz Threat Center to find vulnerable instances. Everyone else should scan their fleet for Apache versions and check whether mod_http2 is loaded.

• Upgrade to Apache HTTP Server 2.4.71 or later.
• Update standalone mod_h2 builds to newer than 2.0.42.
• If patching is delayed, disable HTTP/2 by removing h2 and h2c from the Protocols directive.
• Scan container images and rebuild any that bundle an affected Apache version.

What it means for you

If you run Apache HTTP Server with HTTP/2 enabled, this affects you regardless of where you're hosted. The patch is available now, and most Linux distributions will push updated packages in the coming days. Check your package manager for Apache 2.4.71 or later.

For organizations in the US, UK, and EU, the calculus is simple: the cost of patching is a maintenance window; the cost of not patching could be a breach. Cloud providers will likely update managed services, but self-managed instances are your responsibility.

Apache 2.4.71 is out, and the fix is a version bump. The hard part is finding every instance in your environment—especially the ones baked into container images. Start with anything public-facing, then work inward. The web runs on Apache; keeping it patched is everyone's job.