If you run a website on the Apache HTTP Server with HTTP/2 switched on, drop what you are doing and check your version. A critical flaw in the mod_http2 module lets a remote attacker run code on the server without any login, and the Apache HTTP Server project shipped the fix in version 2.4.71 on 11 November 2026. The bug carries a CVSS score of 9.8 out of 10 and affects versions 2.4.55 through 2.4.70.
Here is what the flaw is, which servers are exposed, and the exact steps to close it.
What Is CVE-2026-119618
CVE-2026-119618 is a memory safety flaw in the HTTP/2 module of the Apache HTTP Server. An attacker who can reach the server needs no authentication to exploit it and could take full control of the server process, according to Red Hat’s assessment. In plain terms, that is the account your web server runs as: the attacker could serve malicious pages, read site files, or pivot further into the machine.
The vulnerability matters more than the usual critical bug because the bar to exploit it is low. Red Hat’s write-up says public research has demonstrated a reliable exploit against a server in its default configuration with mod_http2 enabled. It did not name that research. Security company Wiz, which published its own analysis the same day, said no exploit was publicly available and that no exploitation in the wild had been reported so far. Both statements can be true at once: a working exploit exists in research hands, but it has not reached the mass-scanning crowd yet. That gap is your window to patch.
Which Servers Are Affected
Only servers with HTTP/2 enabled are exposed. The module documentation explains that HTTP/2 runs only where the Protocols directive turns it on: h2 for HTTP/2 over TLS and h2c for HTTP/2 over plain TCP. The directive can be set for the whole server or for a single virtual host, so one enabled vhost is enough to put the box at risk.
The affected ranges:
- Apache HTTP Server 2.4.55 through 2.4.70 with mod_http2 enabled
- Standalone builds of the module released on GitHub as mod_h2, versions 2.0.8 through 2.0.42
Distribution builds use their own package versions. Red Hat Enterprise Linux 9 and 10 shipped fixes on 10 November, for example as mod_http2-2.0.26-7.el9_9.1 on RHEL 9. Red Hat rates the flaw as Important rather than Critical on those releases because each HTTP/2 stream gets its own memory allocator in their build, which makes an attack much harder. RHEL 8 and earlier do not contain the vulnerable code at all. Debian and Amazon Linux trackers list their own fixed package versions. Ubuntu’s CVE tracker had no page for the flaw when The Hacker News checked on 12 November.
How to Fix It
- Check your version. Run httpd -v or apache2 -v, and check the distro package with rpm -q mod_http2 or dpkg -l libapache2-mod-http2.
- Check whether HTTP/2 is enabled. Look for the Protocols directive in your server config and in every virtual host block. Look for h2 or h2c.
- Update to Apache HTTP Server 2.4.71 if you build from source. Distribution users should install the patched mod_http2 package from their vendor instead of the version numbers in the table above.
- Restart the service and confirm the new version is live with httpd -v again.
- Watch your logs for unusual h2 traffic patterns from the days before the patch, especially from IPs that only ever spoke HTTP/2.
Version 2.4.71 fixes two other issues along the way: a crash in mod_md rated important and a one-byte overwrite of stack memory in mod_vhost_alias rated low. If you are updating anyway, you get all three fixes in one go.
No Patch Yet? Use the Workaround
The Apache security advisory offers no official workaround, but Wiz’s vulnerability analysis points to one that removes the attack surface entirely: take h2 and h2c out of the Protocols directive and leave it as Protocols http/1.1. Your site keeps working over HTTP/1.1 until you can update.
The standalone mod_h2 project has published no fixed release. Its GitHub release list ends at 2.0.42, the last affected version, and the repository has been read-only since it was archived on 9 June. If you build mod_h2 from that project, the Protocols change is your only option.
Tips for Admins Managing Many Servers
- Do not trust the main config alone. The Protocols directive can be set per virtual host, and a single h2 vhost on an otherwise HTTP/1.1 server is still exposed.
- Config management pays off here. Ansible, Puppet or a simple cron script that runs httpd -v across your fleet will tell you in seconds which boxes are still in the 2.4.55 to 2.4.70 range.
- Remember the TLS terminator. If a load balancer or CDN speaks HTTP/2 to clients and HTTP/1.1 to your origin, your origin may not be affected at all. Check where mod_http2 actually runs.
- Turn on vendor advisories. Red Hat, Debian and Amazon Linux shipped fixes within a day of the Apache advisory, which is faster than most teams patch on their own.
- Keep the workaround in your back pocket. The Protocols http/1.1 change takes seconds to apply and can be rolled back once the patched package is installed.
Frequently Asked Questions
What is CVE-2026-119618?
It is a critical flaw in the Apache HTTP Server’s mod_http2 module that allows unauthenticated remote code execution. It affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released on 11 November 2026. Red Hat rates it 9.8 out of 10 on the CVSS scale.
Does the Apache HTTP/2 flaw affect my server?
Only if HTTP/2 is enabled through the Protocols directive with h2 or h2c. Check the server-wide setting and every virtual host block. If you only terminate HTTP/2 at a CDN or load balancer, your origin may not be exposed.
How do I fix the Apache mod_http2 vulnerability?
Update to Apache HTTP Server 2.4.71, or install your distribution’s patched mod_http2 package. If you cannot update right away, remove h2 and h2c from the Protocols directive so the server speaks only HTTP/1.1.
Is the Apache HTTP/2 flaw being exploited in the wild?
As of 12 November 2026, Wiz reported that no exploitation in the wild had been observed and no public exploit was available. Red Hat’s assessment says public research has demonstrated a reliable exploit against default configurations, so admins should treat the window as short.
