Security firm Wiz said on 11 November that Apache HTTP Server has a critical flaw, tracked as CVE-2026-119618. It sits in mod_http2, the module that handles HTTP/2 traffic. Wiz said threads running at the same time share data in the assign_headers() function without proper coordination. That corrupts heap memory, the space a program uses for working data. A remote attacker with no login could then run commands with the web server's privileges. Anthropic and Google Cloud's Vulnerability Research Team each found it independently, Wiz said.
Wiz said no exploit was available and no attacks in the wild were reported when it published. Its data shows 64% of cloud environments have vulnerable resources, and 51% have publicly exposed instances. Wiz said both figures ignore configuration. Wiz also said that in the cloud, a compromised Apache server could be an entry point to neighbouring services or cloud metadata endpoints.
Exposure depends on whether HTTP/2 is on, so first list which servers use it. The fix is the same: upgrade to 2.4.71 or later. Because the attack needs no login, internet-facing servers are the obvious place to start. Leaders can ask their teams which servers run HTTP/2, which face the internet, and what a taken-over server could reach. Wiz says teams that cannot patch yet can turn HTTP/2 off.