Apache Patches Critical HTTP Server RCE Found by Anthropic, Google
Apache has patched a critical HTTP Server vulnerability that could allow unauthenticated remote code execution, following independent discoveries by Anthropic and Google researchers.
The vulnerability resides in mod_http2, the module responsible for handling HTTP/2 traffic, and involves a race condition where multiple threads improperly access shared resources, potentially corrupting server memory. According to Red Hat, an attacker could exploit the issue remotely without authentication to execute arbitrary commands and gain control of the server process.
Vulnerability Details
Red Hat assigned the vulnerability a CVSS score of 9.8 and explained that "only servers that have HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable." Apache credited Anthropic's OSS Scanner with reporting the flaw on October 26, while Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research independently reported the same vulnerability on November 3.
Exploitation Risk
Cloud security firm Wiz reported that 64% of cloud environments in its data contained resources running affected Apache versions, while 51% had publicly exposed instances. Red Hat says public research has demonstrated a reliable exploit against a server with mod_http2 enabled, though no exploit was publicly available as of November 11.
only servers that have HTTP/2 enabled are affected; servers configured to serve only HTTP/1.1 are not vulnerable.
Mitigation
Organizations are advised to install Apache HTTP Server 2.4.71 or vendor-supplied packages. Disabling HTTP/2 can temporarily prevent exploitation if updates cannot be deployed immediately. Defiant warned that WordPress security updates cannot resolve the issue because it affects the underlying web server. Apache HTTP Server 2.4.71 also fixes two other vulnerabilities: CVE-2026-106023 and CVE-2026-109163.
Related
