Apache HTTP Server flaw enables unauthenticated remote code execution over HTTP/2
Apache HTTP Server versions 2.4.55 through 2.4.70 contain a critical flaw in the mod_http2 module that can let an unauthenticated remote attacker run code on the server, The Hacker News reported on November 12. The Apache project fixed the issue in version 2.4.71, released yesterday.
The vulnerability is tracked as CVE-2026-119618. Red Hat said an attacker only needs network access to the server and could gain full control of the server process; it rated the issue 9.8 out of 10 on the CVSS scale. Only servers with HTTP/2 enabled are affected.
The available reporting gives different signals about exploitation. Red Hat said public research had demonstrated a reliable exploit against a server in its default configuration with mod_http2 enabled. Wiz later said that no exploit was available and that it had found no exploitation in the wild.
Administrators should check the Protocols directive at server level and in every virtual host, because Apache can enable HTTP/2 with h2 over TLS or h2c over plain TCP. The Apache HTTP Server project says operators should move to 2.4.71. Wiz advises those who cannot update to remove h2 and h2c from the directive and leave Protocols http/1.1.
The same issue affects standalone mod_h2 builds from version 2.0.8 through 2.0.42. The project has published no fixed release, and its repository has been read-only since June 9, according to the report. The Protocols mitigation also applies to those builds.
Distribution packages use their own version numbers. Red Hat said it shipped fixes for Red Hat Enterprise Linux 9 and 10, while Red Hat Enterprise Linux 8 and earlier do not contain the vulnerable code. The report said the Red Hat Enterprise Linux 9 fix is provided as mod_http2-2.0.26-7.el9_9.1.
Anthropic's OSS Scanner reported the flaw on October 26, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported it last week, according to the report. Updating to the earlier Apache fix for CVE-2026-23918 does not address this issue: servers on 2.4.67 through 2.4.70 remain affected.