Apache fixes HTTP/2 flaw enabling unauthenticated remote code execution

A critical remote code execution flaw in Apache HTTP Server’s HTTP/2 module, mod_http2, could allow unauthenticated attackers to run code on affected servers. Tracked as CVE-2026-119618, the vulnerability affects Apache HTTP Server versions 2.4.55 through 2.4.70 and is fixed in 2.4.71, which was released yesterday. Red Hat notes that only servers with HTTP/2 enabled are affected, and the issue carries a CVSS score of 9.8 out of 10.

Public research has demonstrated a reliable exploit against a server in default configuration with mod_http2 enabled, according to Red Hat’s security advisory.

Industry responses vary. Red Hat’s advisories for Red Hat Enterprise Linux 9 and 10 rate the flaw as Important rather than Critical, and their fixes ship with mod_http2 packages such as mod_http2-2.0.26-7.el9_9.1 on RHEL 9, and mod_http2-2.0.29-5.el10_3.1 on RHEL 10; RHEL 8 and earlier are not affected. The Apache HTTP Server project’s own releases also indicate 2.4.71 as the fixed version. Standalone mod_h2 builds on GitHub were affected up to 2.0.42, with no fixed release published there.

Debian unstable has been fixed, while Debian bookworm, trixie and forky remain vulnerable, and Amazon Linux and Ubuntu statuses vary. The advisory notes no workaround, though Wiz advised removing h2 and h2c from the Protocols directive for those unable to update. The flaw was reported on 26 October by Anthropic’s OSS Scanner, with Google Cloud Vulnerability Research researchers Anthony Weems and Simon Scannell credited for initial disclosure.