Critical Apache HTTP Server Flaw in mod_http2 Enables Unauthenticated Remote Code Execution
A critical vulnerability in Apache HTTP Server’s HTTP/2 module, mod_http2, could let a remote attacker run code on vulnerable servers. The flaw is tracked as CVE-2026-119618 and rated 9.8 on the CVSS scale. It affects Apache HTTP Server versions 2.4.55 through 2.4.70 and is fixed in the newly released version 2.4.71.
Who is affected
Only servers with HTTP/2 enabled are vulnerable. HTTP/2 is turned on with the Protocols directive: h2 enables HTTP/2 over TLS, and h2c enables HTTP/2 over plain TCP. The directive can be set for the whole server or for a single virtual host, so admins should check both the server-wide setting and every virtual host. Standalone builds of the module, distributed on GitHub as mod_h2, are also affected from version 2.0.8 through 2.0.42.
Impact
An attacker who can reach the server needs no authentication to exploit the flaw and could take full control of the server process. Apache HTTP Server is one of the most widely deployed web servers, so many internet-facing systems could be exposed.
Exploitation status: conflicting reports
Red Hat’s assessment says public research has shown a reliable exploit against a default configuration with mod_http2 enabled, but it does not name or link that research. Wiz, however, said that no exploit was available and that no exploitation in the wild had been reported. Given the severity and how quickly attackers turn patches into exploits, organizations should treat this flaw as urgent either way.
Patch status by platform
| Platform | Status | Fixed package |
|---|---|---|
| Apache HTTP Server project releases | Fixed | 2.4.71 |
| Red Hat Enterprise Linux 9 | Fixed (RHSA-2026:98981) | mod_http2-2.0.26-7.el9_9.1 |
| Red Hat Enterprise Linux 10 | Fixed (RHSA-2026:98978) | mod_http2-2.0.29-5.el10_3.1 |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, and 9.6, 9.8, 10.0 and 10.2 Extended Update Support | Fixed (RHSA-2026:98968, RHSA-2026:98954, RHSA-2026:98982, RHSA-2026:98953 and RHSA-2026:98979) | See each advisory |
| Red Hat Enterprise Linux 6, 7 and 8 | Not affected | None needed |
| Red Hat JBoss Core Services and Red Hat Hardened Images | Affected, no fix listed | None listed |
| Debian unstable (sid) | Fixed | apache2 2.4.71-1 |
| Debian bookworm, trixie and forky | Vulnerable | None listed |
| Amazon Linux 2 (Core), Amazon Linux 2023 and Amazon Linux 2027 Preview | Pending fix | None listed |
| Ubuntu | No status page | None listed |
Earlier patch is not enough
Admins who updated for an earlier HTTP/2 flaw, CVE-2026-23918 (fixed in 2.4.67 in May), are still exposed. Every version from 2.4.67 through 2.4.70 is affected by this new vulnerability.
Discovery
The flaw was reported on October 26 by Anthropic’s OSS Scanner, a free AI-powered scanning service for open-source projects. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported it separately last week.
Recommendations
- Upgrade Apache HTTP Server to 2.4.71, or apply your distribution’s patched package as soon as it is available.
- If you cannot update right away, remove
h2andh2cfrom the Protocols directive, leavingProtocols http/1.1, in the server-wide configuration and every virtual host. Apache’s advisory offers no official workaround; this mitigation comes from Wiz. - Inventory all internet-facing Apache servers, including those running standalone mod_h2 builds or distribution packages that don’t have a fix yet.
- Watch web servers for unexpected crashes, unusual child processes, or suspicious outbound connections until patching is complete.
We will update this post as distributions release fixes or if active exploitation is confirmed.
