On this page
Apache released httpd 2.4.71 on November 11 to fix CVE-2026-119618, a race in mod_http2's assign_headers() that corrupts the heap and can let an unauthenticated attacker run code on the server. It affects 2.4.55 through 2.4.70, every release since January 2023 (Apache's advisory). Red Hat rates it 9.8 and says public research has shown a reliable exploit against a default server with mod_http2 enabled, while Wiz said on November 11 that no exploit was available (Wiz's post). Red Hat also says only servers with HTTP/2 enabled are affected: one that serves only HTTP/1.1 is not (Red Hat's page).
So the servers that matter are the ones in that range that negotiate HTTP/2. Web IP has both halves for every host that answered on port 443 or 80: the Server header it sent and the HTTP version it negotiated. Its pass of November 3 to 6, all of it before the fix, found 3,844,748 servers on port 443 whose Server header said Apache.
687,143 in range, 109,773 on HTTP/2
687,143 of those servers named a version from 2.4.55 to 2.4.70, and 109,773 of them (16.0%) negotiated HTTP/2. Another 662,243 named an earlier 2.4 release and 76,435 a release before 2.4, which this flaw doesn't affect. 2,418,790 named no full version, among them 2,304,932 with a bare Apache, 103,404 with Apache/2 and 6,498 with Apache/2.4.
On Amazon's networks, 39% on HTTP/2
The 687,143 in range, by the build their Server header named:
| Build | Servers | Negotiated HTTP/2 | Share |
|---|---|---|---|
| Ubuntu | 251,984 | 26,936 | 10.7% |
| Debian | 202,890 | 28,181 | 13.9% |
| RHEL, Rocky, AlmaLinux, CentOS Stream, Oracle Linux | 66,059 | 7,552 | 11.4% |
| Amazon Linux | 62,042 | 32,692 | 52.7% |
Unix or no OS named | 50,601 | 8,475 | 16.7% |
| Windows | 32,950 | 2,567 | 7.8% |
| cPanel | 5,059 | 464 | 9.2% |
| Other | 15,558 | 2,906 | 18.7% |
Amazon Linux's row takes in 18,171 servers whose header has empty parentheses, as in Apache/2.4.62 (), which is how Amazon Linux 2 sends it: 18,117 of them were on Amazon's networks.
61,751 of Amazon Linux's 62,042 servers were on Amazon's networks, where the other builds negotiated HTTP/2 more often too: Ubuntu's servers 26.1% of the time against 6.6% elsewhere, Debian's 30.8% against 10.1%, and every build together 38.7% against 8.9%.
The largest single versions were Ubuntu's 2.4.58 with 194,624 servers, 19,235 of them on HTTP/2, then Debian's 2.4.68 with 82,071 (9,500) and 2.4.69 with 53,642 (11,988), and the RHEL family's 2.4.62 with 50,648 (4,891). Amazon Linux's 2.4.69 had 22,713, and 14,530 of them negotiated HTTP/2.
82% on hosting networks
Of the 109,773 on HTTP/2, 90,383 (82.3%) were on hosting networks and 15,290 (13.9%) on ISP networks. Amazon's AS16509 and AS14618 held 62,990 of them (57.4%). OVH's AS16276 followed with 4,078, DigitalOcean's AS14061 with 2,094 and Liquid Web's AS32244 with 1,346.
What a Server header can't tell you
The pass came before every fix, so none of these servers was patched yet. Red Hat fixed RHEL 9 and 10 on November 11 with an update to its mod_http2 package, so a patched server's header doesn't change: 64,122 of the family's 66,059 servers in range said 2.4.62, 2.4.63 (8,881) or 2.4.57 (4,593). Red Hat rates RHEL 9 and 10 Important rather than Critical, and RHEL 8 isn't affected. Debian's fix is 2.4.71 itself, for bookworm and trixie (Debian's tracker), so a Debian server that has updated says so. Ubuntu listed every release as "Needs evaluation" on November 13 (Ubuntu's page).
852,547 of the servers with a bare Apache negotiated HTTP/2, and nobody outside can tell which of them run an affected version. The networks with the most bare Apache servers were Amazon's AS16509 with 239,467, Oracle's AS31898 with 100,564 and GoDaddy's AS398101 with 94,538, 89,479 of them on HTTP/2. Whoever runs those servers can check them, and on shared hosting such as GoDaddy's that's the host.
HTTP/2 is what the address negotiated, and that isn't always Apache. A load balancer can speak HTTP/2 to clients and HTTP/1.1 to the Apache behind it, passing Apache's Server header through: Amazon's Application Load Balancer sends requests to its targets over HTTP/1.1 by default (AWS's docs). 7,784 of the 109,773 set its AWSALB cookie, against 325 of the 577,370 in range that didn't negotiate HTTP/2. The other way, Web IP records the site an address serves by default, not every site it hosts, and a server can turn HTTP/2 on for its named sites alone. So 109,773 counts the addresses offering HTTP/2 in front of an affected version, and can be off in either direction. Cleartext HTTP/2 on port 80 (h2c), which Red Hat also lists, isn't in this count.
What to do
Apache's fix is 2.4.71. Debian and Red Hat had fixed packages out by November 13, and Ubuntu had none. Until a server is fixed, Protocols http/1.1 turns HTTP/2 off: set it in the main configuration and in every virtual host that has a Protocols line of its own, which overrides the main one.
To find these servers in the ranges you own or protect, filter Web IP on its port, last_seen, server and http_version columns. This is the filter behind the counts above, and on a newer build last_seen picks the pass you want:
port = 443
AND last_seen >= DATE '2026-11-03'
AND regexp_like(server, '^Apache/2\.4\.(5[5-9]|6[0-9]|70)([^0-9]|$)')
AND http_version = 'HTTP/2.0'Join the matches to IP ASN for each address's network, and to ASN for that network's type. The same count for PHP: PHP2Shell, measured.
How we counted
We took Web IP's newest row of each address on port 443 seen from November 3 to 6, and counted it as Apache when its Server header was Apache or started Apache/ or Apache , which leaves out Tomcat's Apache-Coyote. The version is the one after Apache/. A build is the operating system the header names in parentheses. HTTP/2 counts where the HTTP version column reads HTTP/2.0. A server's network is its address's origin network in IP ASN, typed by ASN.
Getting access
Web IP is a gzipped CSV download, and its docs list the columns. To license it, see pricing or talk to us.
