Apache HTTP/2 Flaw Could Allow Unauthenticated Remote Code Execution
Summary
CVE-2026-119618 affects Apache HTTP Server 2.4.55–2.4.70 when HTTP/2 is enabled; version 2.4.71 fixes it. Red Hat says reliable exploit research exists, while Wiz reported no available exploit or in-the-wild activity.
Key points
- The flaw affects Apache HTTP Server versions 2.4.55 through 2.4.70 when HTTP/2 is enabled; an unauthenticated attacker who can reach a server could take control of its server process.
- Apache fixed the flaw in version 2.4.71. Red Hat also released fixes for RHEL 9 and 10; RHEL 8 and earlier do not contain the vulnerable code.
- Red Hat says public research demonstrated a reliable exploit in a default configuration with mod_http2 enabled. Wiz said no exploit was available and no in-the-wild exploitation had been reported.
- Administrators unable to update can remove h2 and h2c from the Protocols directive, leaving http/1.1, according to Wiz.
- Standalone mod_h2 versions 2.0.8 through 2.0.42 are affected; the project has published no fixed release and its repository is archived.
- The flaw was reported by Anthropic's OSS Scanner and Google Cloud Vulnerability Research. It is rated 9.8 out of 10 on the CVSS scale.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution
- Severity
- Critical; CVSS 9.8/10. Red Hat rates the flaw Important on Red Hat Enterprise Linux 9 and 10.
- Affected Versions
- Apache HTTP Server 2.4.55 through 2.4.70
- Standalone mod_h2 2.0.8 through 2.0.42
- Exploitation Status
- not_reported
- Exploit Availability
- public_exploit
- Patch Status
- partial
- Workarounds
- Remove h2 and h2c from the Protocols directive, leaving Protocols http/1.1.
MITRE ATT&CK
CVE
People
Vendors
Apache HTTP Server projectAdmins who run the Apache HTTP Server project's own releases should move to version 2.4.71, the fixed release named in its security advisory. That release also fixes a crash in mod_md, rated important, and a one-byteRed HatOnly servers with HTTP/2 enabled are affected, according to Red Hat, which ships the server as part of Red Hat Enterprise Linux.
Products
Apache HTTP ServerA critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71,mod_h2Standalone builds of the module, released on GitHub as mod_h2, are affected from version 2.0.8 through 2.0.42.mod_http2A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71,Red Hat Enterprise LinuxOnly servers with HTTP/2 enabled are affected, according to Red Hat, which ships the server as part of Red Hat Enterprise Linux.