Apache httpd shipped a critical HTTP/2 RCE yesterday, and one of the finders was a machine: CVE-2026-119618 and the three-gate audit

8.9 relevance

Critical security vulnerability found by AI scanner, highly actionable and strategically important.

AI/ML dev.to

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For platform engineers running Apache in production, this is an immediate patch priority: 64% cloud exposure, no public exploit yet but weaponization historically measured in days, and the interim mitigation (disabling HTTP/2) impacts performance.

Key Takeaways

Patch to httpd 2.4.71 immediately; if unable, disable HTTP/2 via 'Protocols http/1.1' in httpd.conf as a 48-hour stopgap.

Apache httpd shipped a critical HTTP/2 RCE yesterday, and one of the finders was a machine: CVE-2026-119618 and the three-gate audit

Summary

Apache httpd 2.4.71 patches CVE-2026-119618, a critical HTTP/2 RCE from a race condition in mod_http2's assign_headers() affecting versions 2.4.55–2.4.70. Wiz telemetry shows 64% of cloud environments have a vulnerable instance, 51% publicly exposed. Notably, Anthropic's OSS Scanner—previously criticized for 56% false-positive rate—was the first finder, demonstrating that high-noise AI tools can still deliver high-signal security findings.

Author

Sam LABBE