# Apache CVE-2026-119618: 109,773 in-range servers on HTTP/2

The Apache vulnerability needs HTTP/2: of 687,143 HTTPS servers naming an affected httpd version from November 3 to 6, 109,773 negotiated it.

Apache released httpd 2.4.71 on November 11 to fix CVE-2026-119618, a race in mod_http2's `assign_headers()` that corrupts the heap and can let an unauthenticated attacker run code on the server. It affects 2.4.55 through 2.4.70, every release since January 2023 ([Apache's advisory](https://httpd.apache.org/security/vulnerabilities_24.html)). Red Hat rates it 9.8 and says public research has shown a reliable exploit against a default server with mod_http2 enabled, while Wiz said on November 11 that no exploit was available ([Wiz's post](https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability)). Red Hat also says only servers with HTTP/2 enabled are affected: one that serves only HTTP/1.1 is not ([Red Hat's page](https://access.redhat.com/security/cve/cve-2026-119618)).

So the servers that matter are the ones in that range that negotiate HTTP/2. [Web IP](https://internetdata.io/databases/web-ip) has both halves for every host that answered on port 443 or 80: the Server header it sent and the HTTP version it negotiated. Its pass of November 3 to 6, all of it before the fix, found 3,844,748 servers on port 443 whose Server header said Apache.

## 687,143 in range, 109,773 on HTTP/2

687,143 of those servers named a version from 2.4.55 to 2.4.70, and 109,773 of them (16.0%) negotiated HTTP/2. Another 662,243 named an earlier 2.4 release and 76,435 a release before 2.4, which this flaw doesn't affect. 2,418,790 named no full version, among them 2,304,932 with a bare `Apache`, 103,404 with `Apache/2` and 6,498 with `Apache/2.4`.

## On Amazon's networks, 39% on HTTP/2

The 687,143 in range, by the build their Server header named:

| Build | Servers | Negotiated HTTP/2 | Share |
|---|---:|---:|---:|
| Ubuntu | 251,984 | 26,936 | 10.7% |
| Debian | 202,890 | 28,181 | 13.9% |
| RHEL, Rocky, AlmaLinux, CentOS Stream, Oracle Linux | 66,059 | 7,552 | 11.4% |
| Amazon Linux | 62,042 | 32,692 | 52.7% |
| `Unix` or no OS named | 50,601 | 8,475 | 16.7% |
| Windows | 32,950 | 2,567 | 7.8% |
| cPanel | 5,059 | 464 | 9.2% |
| Other | 15,558 | 2,906 | 18.7% |

Amazon Linux's row takes in 18,171 servers whose header has empty parentheses, as in `Apache/2.4.62 ()`, which is how Amazon Linux 2 sends it: 18,117 of them were on Amazon's networks.

61,751 of Amazon Linux's 62,042 servers were on Amazon's networks, where the other builds negotiated HTTP/2 more often too: Ubuntu's servers 26.1% of the time against 6.6% elsewhere, Debian's 30.8% against 10.1%, and every build together 38.7% against 8.9%.

The largest single versions were Ubuntu's 2.4.58 with 194,624 servers, 19,235 of them on HTTP/2, then Debian's 2.4.68 with 82,071 (9,500) and 2.4.69 with 53,642 (11,988), and the RHEL family's 2.4.62 with 50,648 (4,891). Amazon Linux's 2.4.69 had 22,713, and 14,530 of them negotiated HTTP/2.

## 82% on hosting networks

Of the 109,773 on HTTP/2, 90,383 (82.3%) were on hosting networks and 15,290 (13.9%) on ISP networks. Amazon's AS16509 and AS14618 held 62,990 of them (57.4%). OVH's AS16276 followed with 4,078, DigitalOcean's AS14061 with 2,094 and Liquid Web's AS32244 with 1,346.

## What a Server header can't tell you

The pass came before every fix, so none of these servers was patched yet. Red Hat fixed RHEL 9 and 10 on November 11 with an update to its mod_http2 package, so a patched server's header doesn't change: 64,122 of the family's 66,059 servers in range said 2.4.62, 2.4.63 (8,881) or 2.4.57 (4,593). Red Hat rates RHEL 9 and 10 Important rather than Critical, and RHEL 8 isn't affected. Debian's fix is 2.4.71 itself, for bookworm and trixie ([Debian's tracker](https://security-tracker.debian.org/tracker/CVE-2026-119618)), so a Debian server that has updated says so. Ubuntu listed every release as "Needs evaluation" on November 13 ([Ubuntu's page](https://ubuntu.com/security/CVE-2026-119618)).

852,547 of the servers with a bare `Apache` negotiated HTTP/2, and nobody outside can tell which of them run an affected version. The networks with the most bare `Apache` servers were Amazon's AS16509 with 239,467, Oracle's AS31898 with 100,564 and GoDaddy's AS398101 with 94,538, 89,479 of them on HTTP/2. Whoever runs those servers can check them, and on shared hosting such as GoDaddy's that's the host.

HTTP/2 is what the address negotiated, and that isn't always Apache. A load balancer can speak HTTP/2 to clients and HTTP/1.1 to the Apache behind it, passing Apache's Server header through: Amazon's Application Load Balancer sends requests to its targets over HTTP/1.1 by default ([AWS's docs](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html)). 7,784 of the 109,773 set its `AWSALB` cookie, against 325 of the 577,370 in range that didn't negotiate HTTP/2. The other way, Web IP records the site an address serves by default, not every site it hosts, and a server can turn HTTP/2 on for its named sites alone. So 109,773 counts the addresses offering HTTP/2 in front of an affected version, and can be off in either direction. Cleartext HTTP/2 on port 80 (h2c), which Red Hat also lists, isn't in this count.

## What to do

Apache's fix is 2.4.71. Debian and Red Hat had fixed packages out by November 13, and Ubuntu had none. Until a server is fixed, `Protocols http/1.1` turns HTTP/2 off: set it in the main configuration and in every virtual host that has a `Protocols` line of its own, which overrides the main one.

To find these servers in the ranges you own or protect, filter Web IP on its `port`, `last_seen`, `server` and `http_version` columns. This is the filter behind the counts above, and on a newer build `last_seen` picks the pass you want:

```sql
port = 443
AND last_seen >= DATE '2026-11-03'
AND regexp_like(server, '^Apache/2\.4\.(5[5-9]|6[0-9]|70)([^0-9]|$)')
AND http_version = 'HTTP/2.0'
```

Join the matches to [IP ASN](https://internetdata.io/databases/ip-asn) for each address's network, and to [ASN](https://internetdata.io/databases/asn) for that network's type. The same count for PHP: [PHP2Shell, measured](https://internetdata.io/blog/php2shell).

## How we counted

We took Web IP's newest row of each address on port 443 seen from November 3 to 6, and counted it as Apache when its Server header was `Apache` or started `Apache/` or `Apache `, which leaves out Tomcat's `Apache-Coyote`. The version is the one after `Apache/`. A build is the operating system the header names in parentheses. HTTP/2 counts where the HTTP version column reads `HTTP/2.0`. A server's network is its address's origin network in IP ASN, typed by ASN.

## Getting access

Web IP is a gzipped CSV download, and [its docs](https://docs.internetdata.io/database/web-ip) list the columns. To license it, see [pricing](https://internetdata.io/pricing) or [talk to us](https://internetdata.io/contact).