CVE-2026-119618: Apache HTTP/2 RCE - Floor 2.4.71 / EA4 25.96, Not httpd -v

CVE-2026-119618 is a critical heap-corruption bug in Apache HTTP Server's mod_http2. Apache says it can lead to remote code execution. Affected range: 2.4.55 through 2.4.70. The fix shipped in 2.4.71 on 11 November 2026. cPanel EasyApache 4 v25.96 (ea-apache24 2.4.71-1) landed 12 November. CISA ADP scores it 8.1 (AV:N/AC:H/PR:N/UI:N). Red Hat scores the same CVE 9.8 (AC:L). Those are two vendor numbers, not one fact.[1][2][4][5][9]

If httpd -v still prints 2.4.70, or Ubuntu still prints 2.4.52 / 2.4.58 without the USN package, you are not done. LiteSpeed is a different binary. A WordPress core update does not patch Apache.

What it is

HTTP/2 multiplexes many streams on one connection. Apache's mod_http2 builds request headers in assign_headers(). Apache's own wording is CWE-362: concurrent execution using a shared resource with improper synchronization, heap corruption and RCE.[1][2]

The attack is an unauthenticated HTTP/2 request to a server that actually speaks HTTP/2. Apache names no login. Red Hat's CVE page adds: only servers with HTTP/2 enabled via the Protocols directive (h2 or h2c) are in scope; HTTP/1.1-only is not this bug.[1][9]

This is not:

Yesterday's LiteSpeed 6.3.7 build 9 CageFS/suEXEC line. Different vendor, different process.
CVE-2026-111497 (Brotli / HTTP2Shell) - that was a compression library, not mod_http2.
CVE-2026-109163 - the low one-byte mod_vhost_alias overwrite in the same 2.4.71 tarball. Patch it because you are already updating; do not treat it as this RCE.[1][5]
A WordPress / PHP / cPanel-core CVE. The floor is the httpd package.

How the engine bug reads - inference, not a PoC. Two threads share header tables without enough locking; a worker can write into memory the connection thread still owns. That is Apache's CWE plus Red Hat's threading sentence. It is not a public RCE write-up from us.[1][9]

How serious is it?

Apache labelled it critical and did not publish a CVSS of its own.[1][3]

CISA ADP (CVE record, updated 13 Nov): 8.1 HIGH, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. SSVC: Exploitation: none, Automatable: no, Technical Impact: total.[2]
Red Hat: 9.8, AV:N/AC:L/.... Same CVE, different complexity. Cite the vendor that shipped your package.[9]

It is not in CISA KEV catalog 2026.11.13 (1,781 entries). Absence from KEV is not “safe.”[10]

Internet-facing Apache with HTTP/2 on is the first patch tier. Shared hosting that enabled mod_http2 for every vhost is the large blast radius.

Who is affected

In scope from primary pages we fetched:

Apache HTTP Server 2.4.55-2.4.70 with mod_http2 loaded and h2 / h2c in Protocols.[1]
Standalone GitHub mod_h2 2.0.8-2.0.42. Apache lists those releases as affected. That tree is not a distro package; if you built it yourself, you own the rebuild.[1]
cPanel EasyApache 4 ea-apache24 2.4.55-2.4.70. Floor: 2.4.71-1 in EA4 v25.96 (12 Nov). v25.95 (11 Nov) is 2.4.70 - still inside the range.[4][5]
Ubuntu apache2: Ubuntu Security High, remote RCE. Fixed packages (USN-9090-1, 12 Nov) keep the old upstream version string and backport the module. 18.04 / 16.04 / 14.04: not affected.[6][7]
Debian bookworm/trixie security: 2.4.71-1~deb12u1 / 2.4.71-1~deb13u1. Unattended bookworm without -security can still be 2.4.68 and vulnerable.[8]
CloudLinux (vendor page, last updated 12 Nov 11:33 UTC): system Apache on CL7 / CL8 not this bug; CL9 / CL10 yes (mod_http2 package). cPanel on any CL runs EA4, not system httpd - use the EA4 floor.[11]

Out of scope unless you prove otherwise: LiteSpeed Enterprise / OpenLiteSpeed (not mod_http2). nginx. Apache with HTTP/2 off. Ubuntu bionic and older per Canonical.

We did not find a Plesk KB at write time. On Plesk, inventory httpd -v / the panel's Apache package and the vendor channel - do not assume EA4 packages apply.

What to do now

See which Apache you actually run, and whether HTTP/2 is on.

command -v httpd; rpm -qf "$(command -v httpd)" 2>/dev/null || dpkg -S "$(command -v apache2)" 2>/dev/null
httpd -v 2>/dev/null || apache2 -v
httpd -M 2>/dev/null | grep -w http2_module
apache2ctl -M 2>/dev/null | grep -w http2_module
rpm -q ea-apache24 ea-apache24-mod_http2 2>/dev/null
dpkg -s ea-apache24-mod-http2 2>/dev/null | sed -n '1,8p'

If http2_module is not loaded, this CVE does not reach you. Still take the package when your channel ships it - 2.4.71 also closes the other two CVEs in that tarball.

Patch, then restart so the old module dies.

cPanel / EA4 (vendor steps; Apache will bounce):

/scripts/update-packages
dnf list installed ea-apache24          # Alma / Rocky / CloudLinux
apt policy ea-apache24                  # Ubuntu cPanel
rpm -q --changelog ea-apache24 | grep -m1 CVE-2026-119618
httpd -v   # want Apache/2.4.71

Want: ea-apache24 2.4.71-1 or newer, changelog line naming CVE-2026-119618. CloudLinux rebuilds used 2.4.71-1~urgent before the cPanel .cpanel build; either is 2.4.71.[4][5][11]

Ubuntu (package version, not Apache/2.4.71):

apt-get update
apt-get install --only-upgrade apache2 apache2-bin
apache2 -v
apt-cache policy apache2

Floors from USN-9090-1: 26.10 2.4.68-1ubuntu6.2 · 26.04 2.4.66-2ubuntu2.8 · 24.04 2.4.58-1ubuntu8.19 · 22.04 2.4.52-1ubuntu4.27 · 20.04 ESM 2.4.41-4ubuntu3.23+esm11.[7]

Debian:

apt-get update
apt-get install --only-upgrade apache2
# bookworm security: 2.4.71-1~deb12u1   trixie security: 2.4.71-1~deb13u1

RHEL / Alma / Rocky system httpd: update mod_http2 (and httpd if your errata says so) from the vendor channel; confirm the changelog names the CVE. Red Hat's score is 9.8 for their build.[9]

If you cannot patch today, turn HTTP/2 off. Red Hat: set Protocols http/1.1 (strip h2 and h2c), restart. Clients fall back to HTTP/1.1. That is a mitigation, not the fix.[9]

curl -kI --http2 https://127.0.0.1/
# patched-or-mitigated: first line HTTP/1.1
# still speaking h2: HTTP/2

On cPanel, prefer the package update over ripping ea-apache24-mod_http2 unless you are waiting on a mirror. If you remove the Ubuntu-cPanel module, CloudLinux says purge (apt-get purge ea-apache24-mod-http2) so a leftover conf does not break the start.[11]

Do not trust the version string alone. Ubuntu 22.04 patched at 2.4.52-…ubuntu4.27. EA4 25.95 is 2.4.70. httpd -v without the changelog is how last week's 25.95 boxes look “current.”
Watch after the restart. Patching does not evict an attacker who already ran code as the Apache uid.

Versions with no upstream 2.4.71

Apache 2.2 and anything before 2.4.55: not this CVE (the vulnerable mod_http2 code is not in that range). They have other reasons to die.
icing/mod_h2 GitHub 2.0.8-2.0.42: Apache lists them affected; there is no 2.4.71 for that tree. Migrate to httpd's bundled module or stay on HTTP/1.1.[1]
Ubuntu 18.04 and older: Canonical marks not affected.[6]
CloudLinux 7/8 system Apache: vendor says not this bug. cPanel on CL7/8 still needs EA4 2.4.71.[11]

How to spot a compromise

CISA SSVC said Exploitation: none on 13 November. That is a snapshot, not a promise.[2]

If someone did get code execution it runs as the httpd worker uid (often nobody / apache / the CageFS account on shared), not magically root. Look for:

httpd child crashes / segfaults around the disclosure window (heap corruption is the documented first effect)
new PHP/CGI files under docroots and wp-content/uploads
unexpected outbound curl/wget from the web user
new crons or SSH keys for the Apache uid

Keep access and error logs before you tidy. We are not publishing exploit steps.

FAQ

Is there a patch? Yes. Upstream 2.4.71 (11 Nov). cPanel EA4 25.96 / ea-apache24 2.4.71-1 (12 Nov). Ubuntu USN-9090-1 (12 Nov) with backported packages. Debian security 2.4.71-1~deb12u1 / deb13u1.[1][4][7][8]

Does HTTP/2 have to be on? Yes for this CVE, per Apache's module and Red Hat's Protocols note. Many hosting profiles turn it on. Check, don't assume “default is off” saved you.[1][9]

Is LiteSpeed affected? Not by this CVE. LSWS is not mod_http2. Last week's LiteSpeed floors (LSQUIC build 8, CageFS/suEXEC build 9) are separate work.

Has it been exploited? Not in KEV as of catalog 2026.11.13. CISA ADP SSVC Exploitation: none (13 Nov). We are not treating reseller “in the wild” copy as a primary source.[2][10]

Will a WAF or WordPress update fix it? No. The bug is in the web server process.

Honesty

We did not exploit this.
Apache says the race can lead to RCE. CISA ADP still rates complexity High. Red Hat rates Low. We are not picking a winner; we printed both vectors.[1][2][9]
Not on KEV. Not a ransomware-flagged KEV row.[10]
Public write-ups describe heap corruption and child crashes. A demonstrated, reliable public RCE is not in the Apache advisory. Treat RCE as the vendor's stated outcome, crash as the observed one.
CloudLinux CL7/8 “not affected” is for system Apache only.[11]
Plesk floor: unverified here. Check that vendor.

Sources

[1] https://httpd.apache.org/security/vulnerabilities_24.html - Apache 2.4.71, CVE-2026-119618, 11 Nov 2026
[2] https://www.cve.org/CVERecord?id=CVE-2026-119618 - CNA critical; CISA ADP 8.1, SSVC Exploitation none (13 Nov)
[3] https://www.openwall.com/lists/oss-security/2026/11/11/13 - Eric Covener, oss-security
[4] https://support.cpanel.net/hc/en-us/articles/44958593582103 - EA4 2.4.71-1 / v25.96, 12 Nov 2026
[5] https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/ - 25.96 vs 25.95 (2.4.70)
[6] https://ubuntu.com/security/CVE-2026-119618 - Ubuntu High; jammy 2.4.52-1ubuntu4.27
[7] https://ubuntu.com/security/notices/USN-9090-1 - 12 Nov 2026 package floors
[8] https://security-tracker.debian.org/tracker/CVE-2026-119618 - bookworm/trixie security 2.4.71
[9] https://access.redhat.com/security/cve/cve-2026-119618 - RH 9.8 AC:L; HTTP/2 Protocols scope
[10] https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json - catalog 2026.11.13, 1,781 entries, no CVE-2026-119618
[11] https://cloudlinux.com/security/critical-apache-mod-http2-flaw-cve-2026-119618-cloudlinux - CL7/8 system vs EA4, 12 Nov 11:33 UTC