Apache seals critical HTTP/2 code-execution hole found by Anthropic AI

Apache released version 2.4.71 on Nov. 11, 2026, fixing CVE-2026-119618, a critical flaw in HTTP Server 2.4.55 through 2.4.70. The bug is a race condition: threads handling simultaneous requests can access shared memory without proper coordination. Red Hat says a worker thread can write into memory owned by the connection thread, corrupting server memory and potentially enabling remote command execution. No authentication is needed.

Exposure depends on mod_http2 being loaded and HTTP/2 being enabled; servers serving only HTTP/1.1 are not vulnerable, according to Red Hat's security bulletin. W3Techs' Nov. 14 survey puts Apache on 20.6% of websites whose server software is known. That stat tracks Apache usage, not the share of sites exposed to this specific flaw.

Apache credits Anthropic's OSS Scanner and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research with finding the bug. Its timeline records Anthropic's report on Oct. 26 and Google's on Nov. 3.

Anthropic describes OSS Scanner as a free, opt-in service that uses its AI models to scan open-source repositories. The opt-in service sends findings to maintainers without prior human review, unlike its standard disclosure process. Anthropic says its pipeline uses agents to double-check bugs, propose patches and analyze root causes. Apache's critical rating and released fix make this a concrete case of an AI-scanning report leading to a security patch, not merely a bug claim from the model developer.

The public CVE record's CISA assessment lists exploitation as 'none.' Red Hat says public research has demonstrated a reliable exploit, which is distinct from a report of attacks in the wild.

Operators of affected upstream installations should upgrade to 2.4.71; Apache also lists separately distributed GitHub mod_h2 releases 2.0.8 through 2.0.42 as affected. Red Hat advises checking that mod_http2 is loaded and reviewing active Protocols directives for h2 or h2c, which Apache documents as HTTP/2 over TLS and cleartext HTTP/2, respectively. Where an immediate patch is not possible, Red Hat recommends removing h2 and h2c, leaving Protocols http/1.1, then restarting the server. The Cloud Security Alliance cautions operators to check for dependent services such as gRPC back ends before disabling HTTP/2.