A Critical Apache Web Server Bug Hides in HTTP/2 Support: The Spec Sheet, and a Checklist for Updating or Switching It Off
Apache HTTP Server 2.4.71 fixes CVE-2026-119618, a flaw in the mod_http2 module that Red Hat rates 9.8 and says could let an unauthenticated attacker run code. Only servers with HTTP/2 turned on are exposed. Here are the details and a step-by-step checklist.
Apache HTTP Server still runs a large share of the web, including many of the Linux servers behind company websites and customer portals. A newly fixed bug in its HTTP/2 module is rated critical, but it only matters if HTTP/2 is switched on, which makes the first job simply finding out.
The figures below come from The Hacker News report on the Apache HTTP/2 flaw, which compiled the Apache advisory, Red Hat’s assessment and distribution trackers.
The spec sheet
- Identifier: CVE-2026-119618
- Component: mod_http2, the module that provides HTTP/2 in Apache HTTP Server
- Affected: Apache HTTP Server 2.4.55 through 2.4.70; standalone mod_h2 builds 2.0.8 through 2.0.42
- Fixed in: 2.4.71, released November 11, 2026
- Severity: 9.8 out of 10 (CVSS) per Red Hat for the upstream code; Red Hat rates its own RHEL 9 and 10 packages Important, saying their build makes an attack much harder
- Attacker needs: network access to the server; no login
- Possible result: code running with the privileges of the web server process
- Precondition: HTTP/2 enabled through the Protocols directive (h2 or h2c)
- Exploitation status: disputed. Red Hat’s write-up says public research has demonstrated a reliable exploit but does not cite it; Wiz said later the same day that no exploit was available and no attacks had been reported.
- Found by: Anthropic’s OSS Scanner (reported October 26), and separately Google Cloud Vulnerability Research
- Also in 2.4.71: a crash bug in mod_md (rated important) and a low-rated one-byte stack overwrite in mod_vhost_alias
Where the fixes stand by platform
- Apache project releases: fixed in 2.4.71.
- Red Hat Enterprise Linux 9 and 10: fixed packages released; RHEL 8 and older do not contain the vulnerable code.
- Debian: fixed in unstable; bookworm, trixie and forky were listed as vulnerable with no fix yet.
- Amazon Linux 2 and 2023: fix pending.
- Ubuntu: no status page yet when The Hacker News checked.
- Standalone mod_h2: no fixed release; the project was archived in June.
One trap to note: a server patched in May to 2.4.67 for an earlier HTTP/2 bug is still in the affected range for this one.
Your checklist
- List every server running Apache, including the ones behind marketing sites, client portals, intranets and appliances.
- Check whether HTTP/2 is on. Look at the server-wide Protocols directive and at every virtual host, since each can set its own. If none lists h2 or h2c, this bug does not apply.
- Check the version. Anything from 2.4.55 through 2.4.70 with HTTP/2 enabled needs attention. On Linux distributions, go by the vendor’s package advisory rather than the upstream version number.
- Update to 2.4.71 or your distribution’s fixed package as soon as it exists, then restart the service.
- If you cannot update yet, Wiz suggests removing h2 and h2c so the directive reads Protocols http/1.1. The Apache advisory itself offers no workaround. Pages are then served over HTTP/1.1 instead.
- Ask your hosting provider what they have done, if you use shared or managed hosting where you cannot touch the configuration.
- Re-check after any rebuild or template deployment, so an old image does not quietly bring the vulnerable version back.
What this means for your company
For a business, the risk here is less about Apache specifically and more about knowing what is running on your internet-facing servers. A flaw like this is quick to deal with when you already have a current list of servers, their software versions and who is responsible for each, and slow and stressful when you do not. Pair that inventory with a routine patch window for web servers and a web application firewall or monitoring that would notice unusual behavior, so one missed update is not the only thing between an attacker and your site.
Not sure which of your websites run on Apache, or whether HTTP/2 is switched on? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
