A severe vulnerability discovered in the Apache HTTP Server’s HTTP/2 module, mod_http2, enables remote, unauthenticated attackers to execute code on affected servers. Identified as CVE-2026-119618, the flaw impacts Apache versions 2.4.55 through 2.4.70. The issue was addressed in version 2.4.71, released November 11, 2026.
Who’s Affected & Severity
Servers using HTTP/2 via mod_http2 are at risk. The flaw permits attackers to reach a server without authentication and gain control of its process. The vulnerability carries a CVSS score of 9.8 out of 10. Red Hat, which includes Apache in its Enterprise Linux distribution, confirms that only servers with HTTP/2 enabled are vulnerable. Versions 2.4.55 through 2.4.70 are affected; 2.4.71 resolves the issue.
Distributions, Status & Workarounds
Standalone builds of mod_h2 (versions 2.0.8 through 2.0.42) are also vulnerable. Apache’s own release 2.4.71 fixes the bug. For specific Linux distributions: Red Hat Enterprise Linux (RHEL) 9 and 10 have fixes available in their mod_http2 packages. RHEL 8 and earlier are not impacted. Debian unstable (sid) was updated; other Debian branches remain exposed. Amazon Linux users are still awaiting patches. Ubuntu’s status remains unclear.
No Apache-provided workaround is available. However, security researchers recommend disabling the HTTP/2 protocol by removing both h2 and h2c from the Protocols directive, falling back to HTTP/1.1 until updates are applied. For servers using the standalone mod_h2 project, which hasn’t published a fixed release (latest version is 2.0.42), this workaround applies as well.
Origin & Timeline
The vulnerability was first reported on October 26 via Anthropic’s OSS Scanner—an open-source scanning tool powered by AI. Google Cloud security researchers Anthony Weems and Simon Scannell confirmed the issue in reports published shortly before the patch. Publicly released proof-of-concept exploit code demonstrated a reliable attack for default configurations with mod_http2 enabled. To date, there are no confirmed reports of the flaw being actively exploited in the wild.
This issue follows another HTTP/2 vulnerability, CVE-2026-23918, which was patched in Apache 2.4.67 in May 2026. Despite that earlier fix, servers updated between 2.4.67 and 2.4.70 still remained vulnerable to CVE-2026-119618 until the release of 2.4.71.
Why this matters:A remote code execution flaw that requires no authentication strikes at the heart of web server security—especially for those running HTTP/2 by default. Administrators need to assess their exposure: check if HTTP/2 (h2/h2c) is enabled, verify Apache version, and apply the 2.4.71 update where possible. Where immediate patching isn’t feasible, disabling HTTP/2 is a safe stopgap.
