Apache’s security advisory says a synchronization flaw in its HTTP/2 module can corrupt memory and lead to remote code execution. CVE-2026-119618 affects Apache HTTP Server 2.4.55 through 2.4.70. Apache released 2.4.71 with a fix on November 11.
The issue is in mod_http2, the module that handles HTTP/2. Apache also lists standalone mod_h2 releases 2.0.8 through 2.0.42 as affected. Check whether the module is active and whether untrusted clients can reach it. A version string alone may not reflect a distribution’s backported fix; consult its advisory and package status.
Wiz’s analysis says an unauthenticated remote attacker could exploit the flaw and recommends updating Apache. If an update cannot be applied immediately, Wiz recommends temporarily disabling HTTP/2. Test the change and confirm the affected service no longer offers it. Wiz sells cloud security software; its exposure estimates do not account for configuration.
Apache credits independent reports from Anthropic’s OSS Scanner and Google Cloud Vulnerability Research. Wiz says it knew of no public exploit or reported exploitation in the wild when it published. That statement is time-bound and does not establish that exploitation cannot occur.
What the thread adds
In the Hacker News discussion, rurcliped warns that an automated certificate renewal task can restart a deliberately stopped web server. Check scheduled service dependencies if shutdown is part of a temporary response. z3ratul163071 reported a delay finding updated containers or packages; availability varies by distributor and can change.
From a 152-comment thread, in HN’s own order.