Apache HTTP/2 RCE Flaw CVE-2026-119618: Upgrade to 2.4.71
A critical mod_http2 flaw in Apache 2.4.55 to 2.4.70 lets unauthenticated attackers take over the server process. Upgrade to 2.4.71 or disable HTTP/2.
⚡ Why it matters
Apache is one of the most widely used web servers, especially on shared hosting. If HTTP/2 is enabled on your server, you are at risk until you upgrade or temporarily disable HTTP/2.
The Apache HTTP Server project has released version 2.4.71 to fix a critical vulnerability, CVE-2026-119618, in its HTTP/2 module, mod_http2. Red Hat rates it 9.8 out of 10 and says an attacker who can reach the server needs no authentication to exploit it and could take full control of the server process.
Who is affected?
- Versions 2.4.55 through 2.4.70, and only servers with HTTP/2 enabled via the h2 or h2c option in the Protocols directive.
- Standalone builds of the module (mod_h2) from 2.0.8 through 2.0.42; the standalone project is archived with no fix so far.
- Red Hat Enterprise Linux 8 and earlier are not affected. At the time of the report, the Debian tracker listed bookworm, trixie and forky as affected with no fixed package yet.
Red Hat said published research demonstrated reliable exploitation, while Wiz said no public exploit is available and no attacks have been observed so far.
What to do
- Upgrade to 2.4.71, or to your distribution's fixed package as soon as it is available.
- If you can't upgrade now, remove h2 and h2c from the Protocols directive at the server level and in every virtual host, leaving
Protocols http/1.1, as Wiz recommends. - Check every configuration file, since HTTP/2 may be enabled for a single site only.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Critical CVEs: Synology, SharePoint, VS Code and Routers
Here are the most important critical vulnerabilities published in the US NVD between November 9 and 15, 2026, from Synology and Microsoft to developer tools, WordPress plugins and old home routers, with what to do for each.
Claude 'Office Party' Skills Flaw Runs Code on Linux
AIR Security disclosed Office Party, a flaw in Claude's official Word, PowerPoint and Excel skills that can run malicious code on Linux once a file is planted in a shared temp folder. Anthropic has chosen not to fix it.
Windows Paint Flaw CVE-2026-83844: Update via the Store
Microsoft patched a remote code execution flaw, `CVE-2026-83844`, in Windows Paint after nearly a month of confusion over the fixed version and its Store availability. The safe version is 11.2609.401.0.