Apache HTTP Server with HTTP/2: critical mod_http2 flaw allows remote code execution

What happened

On 11 November 2026 the Apache HTTP Server project published CVE-2026-119618 and released version 2.4.71. The project rates the flaw critical. It is in the HTTP/2 module mod_http2, in the function assign_headers(). Shared resources are not properly synchronised when requests run at the same time. The project's advisory says this causes heap corruption that can lead to remote code execution.

Red Hat rates the flaw 9.8 out of 10 on the CVSS scale. It says an attacker who can reach the server needs no authentication and could take full control of the server process. Red Hat also says that public research has demonstrated a reliable exploit against a default configuration with mod_http2 enabled, but it does not name that research. The security company Wiz said later that no exploit was available and that no attacks had been reported. The vulnerability is not in CISA's catalogue of exploited vulnerabilities, and no source we checked reports any attacks.

Version 2.4.71 also fixes two other flaws:

• CVE-2026-106023 (rated important): a crash in mod_md.
• CVE-2026-109163 (rated low): a one-byte stack overwrite in mod_vhost_alias.

Who is affected

• Apache HTTP Server 2.4.55 to 2.4.70, but only when HTTP/2 is turned on. HTTP/2 only runs where the Protocols directive includes h2 (HTTP/2 over TLS) or h2c (HTTP/2 over plain TCP). This directive can be set for the whole server or for a single virtual host.
• Servers that installed 2.4.67 for the earlier HTTP/2 flaw CVE-2026-23918 are still affected. This applies to every release from 2.4.67 to 2.4.70.
• Standalone builds of the module (mod_h2 from GitHub), versions 2.0.8 to 2.0.42. There is no fixed mod_h2 release yet, and the project's repository has been archived.

These systems are not affected:

• Apache versions before 2.4.55.
• Servers on which neither h2 nor h2c is enabled in any Protocols directive.
• Red Hat Enterprise Linux 6, 7 and 8, which do not contain the vulnerable code.

Status of distribution packages, as of 12 November 2026:

• RHEL 9: fixed in mod_http2-2.0.26-7.el9_9.1 (RHSA-2026:98981).
• RHEL 10: fixed in mod_http2-2.0.29-5.el10_3.1 (RHSA-2026:98978).
• RHEL EUS and SAP releases: fixes are available in separate advisories. Red Hat rates the flaw Important rather than Critical on RHEL 9 and 10, because its builds make an attack much harder.
• Red Hat JBoss Core Services and Red Hat Hardened Images: listed as affected, with no fix yet.
• Debian: unstable (sid) is fixed with apache2 2.4.71-1. Debian's tracker lists bookworm, trixie and forky as vulnerable, with no fixed package yet.
• Amazon Linux 2, Amazon Linux 2023 and Amazon Linux 2027 Preview: a fix is pending.
• Ubuntu: no status had been published yet.

Hosting panels and other products that ship their own Apache build are affected if their build falls in this version range and HTTP/2 is turned on. For their status, check the vendor's advisory.

What to do now

1. Find your Apache version with apachectl -v or httpd -v. Then check whether HTTP/2 is turned on (see the next section).
2. Update.
   • Self-built or upstream Apache: upgrade to 2.4.71.
   • RHEL 9 and 10: install the updates, for example with dnf update mod_http2.
   • Other distributions: install the fixed apache2 or httpd package as soon as your distribution publishes one. Check the vendor advisories linked below.
3. Restart Apache fully, for example with systemctl restart httpd or systemctl restart apache2. A full restart makes sure the updated module is loaded. Then confirm that your sites respond.
4. If you cannot update yet: Apache's advisory offers no workaround. Wiz recommends removing h2 and h2c from every Protocols directive, leaving Protocols http/1.1. Check the server-wide setting and every virtual host. Then test the configuration with apachectl configtest and restart Apache. Clients will fall back to HTTP/1.1. This is also the only protection so far for servers that use the standalone mod_h2 builds.
5. Check your other servers, including reverse proxies and servers you run for customers, if they run Apache 2.4.55 or later with HTTP/2 turned on.

How to check whether you are affected

• Version: run apachectl -v (or httpd -v). Versions 2.4.55 to 2.4.70 are affected. On distribution packages, compare against the fixed package versions listed above, because distributions use their own version numbers.
• Module loaded: apachectl -M 2>/dev/null | grep http2 shows whether mod_http2 is loaded.
• HTTP/2 turned on: run grep -RniE '^\s*Protocols' /etc/httpd /etc/apache2 2>/dev/null and look for h2 or h2c. Include any other directories that hold configuration files.
• From outside: curl -sI --http2 https://example.com -o /dev/null -w '%{http_version}\n' prints 2 if the site answers over HTTP/2.

If none of your servers has h2 or h2c in a Protocols directive, this flaw does not affect them. Still install version 2.4.71 or your distribution's update during normal maintenance, because it also fixes the other two flaws.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-119618
• https://httpd.apache.org/security/vulnerabilities_24.html