Source: Wiz Blog advisory by Merav Bar, published November 11, 2026.
The flaw centers on concurrent thread access to shared memory objects inside the `assign_headers()` routine of `mod_http2`. Because Apache processes multiple multiplexed HTTP/2 streams across worker threads simultaneously, improper locking during header assignment lets a remote client trigger out-of-order memory corruption on the heap without authenticating first. In containerized and virtualized cloud deployments, Wiz warned a compromised web front end can serve as an entry point for lateral movement against internal microservices and instance metadata APIs.
Dual remediation tracks cover both bundled Apache distributions and standalone GitHub modules. Administrators running Apache HTTP Server 2.4.55 through 2.4.70 must upgrade to 2.4.71 or later, while operators compiling standalone `mod_h2` must move newer than 2.0.42. Where immediate binary patching cannot be scheduled without downtime, Wiz recommends temporarily restricting `httpd.conf` to `Protocols http/1.1` and stripping `h2` and `h2c` tokens to remove the vulnerable HTTP/2 code path entirely.
Limits: Wiz noted its 64% and 51% exposure rates measure package version prevalence across scanned cloud estates without accounting for whether `mod_http2` or HTTP/2 protocols are actively enabled in each host's configuration, and neither Anthropic nor Google Cloud published proof-of-concept exploit details.