Critical Apache HTTP/2 flaw could allow unauthenticated attackers to execute code remotely

Swati KhandelwalNovember 12, 2026Vulnerability / Web Security

A critical flaw in the HTTP/2 module of the Apache HTTP server, mod_http2can allow a remote attacker to execute code on the server. Tracked as CVE-2026-119618This affects versions 2.4.55 to 2.4.70 and is fixed in version 2.4.71, released yesterday.

Only servers with HTTP/2 enabled are affected, according to Red Hat, which provides the server as part of Red Hat Enterprise Linux.

An attacker who can access the server does not need any authentication to exploit the flaw and could take full control of the server process, the Linux vendor says. He rates the defect at 9.8 out of 10 on the CVSS scale.

The vendor’s assessment, released yesterday, also states that “public research has demonstrated a reliable exploit” against a server in its default configuration with mod_http2 enabled. It does not name or link this research. Security firm Wiz said later in the day that no exploits were available and no wild exploitation had been reported.

HTTP/2 only runs where the Protocols directive enables it, as explained in the module’s documentation. The directive uses h2 for HTTP/2 over TLS and h2c for HTTP/2 over plain TCP. It can be set for the entire server or for a single virtual host, so administrators should check the settings server-wide and for each virtual host.

Standalone versions of the module, published on GitHub under the name mod_h2, are assigned from version 2.0.8 to 2.0.42.

Administrators running the Apache HTTP Server Project’s own versions should upgrade to version 2.4.71, the patched version mentioned in its security advisory. This release also fixes a crash in mod_md, considered important, and an overwrite of a byte of stack memory in mod_vhost_alias, considered small.

The distributions in the table below provide their own versions of the server, with their own package version numbers. On Red Hat Enterprise Linux 9, for example, the patch ships under the name mod_http2-2.0.26-7.el9_9.1.

Red Hat yesterday delivered patches for Red Hat Enterprise Linux 9 and 10 and rates the flaw as important on these versions rather than critical. Their mod_http2 packages give each HTTP/2 stream its own memory allocator, making an attack much more difficult, depending on the vendor’s severity rating. Red Hat Enterprise Linux 8 and earlier versions do not contain the vulnerable code.

The Debian lines come from the Debian security tracker and the Amazon line comes from the Amazon Linux tracker. Ubuntu’s CVE tracker did not have a page for the flaw when The Hacker News checked it today.

The Apache HTTP Server advisory does not provide any workarounds. In its vulnerability analysis, Wiz advises administrators who cannot yet update to remove h2 and h2c from the Protocols directive, leaving http/1.1 Protocols.

The mod_h2 standalone project has not released any patched versions so far. Its release list on GitHub ends at 2.0.42, the latest affected version, and its repository has been read-only since it was checked in on June 9. The above protocol change also applies to servers using these versions.

The flaw was reported on October 26 by Anthropic’s OSS Scanner, a free scanning service for open source projects that uses the company’s AI models. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported this last week.

An earlier HTTP/2 flaw, CVE-2026-23918, was fixed in version 2.4.67, released on May 4. Servers updated to this version, or later up to 2.4.70, are still running a version affected by the new flaw.