A new vulnerability in Apache HTTP Server could allow an attacker to run malicious code remotely on vulnerable systems. The vulnerability, tracked as CVE-2026-119618, affects the HTTP/2 module (mod_http2) and has a CVSS score of 9.8 which means it is critical. This has been fixed in Apache version 2.4.71 which was released on the 11th November 2026.
The Apache versions affected are between 2.4.55 and 2.4.70. However, only systems where HTTP/2 has been enabled are vulnerable. Red Hat state "An attacker with network access to a vulnerable system could exploit this vulnerability to take control of the server process." As no authentication is required systems that are network accessible could be at high risk.
Red Hat’s analysis of the vulnerability states that there is public research showing a reliable exploit for a server running the default configuration and mod_http2 enabled. The research was not detailed or sourced.
However, cybersecurity firm Wiz state that there is no exploit available and no attacks have been observed in the wild.
HTTP/2 is not enabled by default. It can be enabled globally for all virtual hosts or just on specific virtual hosts. This is done by adding ‘h2’ to the Protocols directive for secure HTTP/2 (TLS) or ‘h2c’ for insecure HTTP/2 (TCP). All configuration files should be reviewed by the security team.
Apache recommend upgrading to version 2.4.71. This also includes a fix for a crash issue in mod_md (Important) and a memory overwrite vulnerability in mod_vhost_alias (Low severity). If you are using official builds of Apache then administrators should upgrade to the latest version.
This also affects standalone versions of the HTTP/2 module (mod_h2).
These versions affected are between 2.0.8 to 2.0.42. There is no fixed version available. The GitHub repository has been archived and the latest version published is 2.0.42.
The patch is available for some OSs. Red Hat have patched Enterprise Linux versions 9 and 10. However, this vulnerability is rated as Important. This is because the HTTP/2 streams use separate memory allocators making it harder to exploit. Enterprise Linux 8 and below are unaffected.
Debian have patched this in their unstable version. Bookworm, trixie and forky are still affected. Amazon Linux 2, 2023 and 2027 Preview are waiting on patches. Ubuntu do not have a specific vulnerability page.
If you cannot patch your systems then Wiz recommend disabling HTTP/2 by removing ‘h2’ and ‘h2c’ from the Protocols directive. This will leave you with HTTP/1.1.
This vulnerability was first reported by Anthropic’s OSS Scanner on the 26th October. The scanner uses Anthropic’s AI models to scan open source software. It was also reported by Anthony Weems and Simon Scannell from Google Cloud Vulnerability Research last week. This comes after another vulnerability in Apache’s HTTP/2 module (CVE-2026-23918) was patched in version 2.4.67 in May. Upgrading to this version or any version after up to 2.4.70 won’t protect your systems from this new vulnerability.
Read the original article:
Apache HTTP/2 Security Flaw Exposes Servers to Critical Remote Code Execution Attacks