A serious security issue has been discovered in the Apache HTTP Server. The Apache HTTP/2 vulnerability, tracked as CVE-2026-119618, could allow remote attackers to execute code on affected servers without logging in.
The flaw affects the HTTP/2 module called mod_http2. It carries a CVSS severity score of 9.8 out of 10, making it a major concern for server administrators.
The Apache project has released a security update to fix the problem. Administrators should check their server versions and apply the update as soon as possible.
Which Apache HTTP Server Versions Are Affected?
The vulnerability affects Apache HTTP Server versions 2.4.55 through 2.4.70, but only when HTTP/2 is enabled.
An attacker who can connect to a vulnerable server may be able to take control of its server process. No authentication is required, which increases the risk for exposed systems.
The issue also affects standalone builds of the mod_h2 module from versions 2.0.8 through 2.0.42.
Apache has released version 2.4.71 to address the main vulnerability. This update also fixes two other security issues involving mod_md and mod_vhost_alias.
How Does the Apache HTTP/2 Vulnerability Work?
HTTP/2 is a network protocol used to improve communication between web browsers and servers. Apache enables it through the Protocols directive.
Administrators can enable HTTP/2 using:
h2for HTTP/2 over TLS.h2cfor HTTP/2 over plain TCP.
The setting can apply to the entire server or individual virtual hosts. This means administrators should check both the main server configuration and every virtual host.
Red Hat reported that research had demonstrated a reliable exploit against a default server configuration with mod_http2 enabled. However, Wiz later stated that no exploit was available and that no attacks had been reported in the wild at that time.
Apache HTTP/2 Vulnerability: Affected Platforms and Fixes
Different Linux distributions provide their own Apache packages. Their package versions and security update schedules may differ.
| Platform | Current status | Recommended action |
|---|---|---|
| Apache HTTP Server | Fixed | Upgrade to 2.4.71 |
| Red Hat Enterprise Linux 9 | Fixed | Install the updated package |
| Red Hat Enterprise Linux 10 | Fixed | Install the updated package |
| Debian unstable (sid) | Fixed | Upgrade to 2.4.71-1 |
| Debian bookworm, trixie and forky | Vulnerable | Monitor security updates |
| Amazon Linux versions listed in the advisory | Pending fix | Check for package updates |
| Red Hat Enterprise Linux 6, 7 and 8 | Not affected | No action required for this flaw |
What Should Server Administrators Do?
The best protection is to install the security update provided by your operating system or server vendor.
Administrators using official Apache releases should upgrade to version 2.4.71. Those using Linux distributions should follow the package instructions provided by their vendor.
If an immediate update is not possible, security researchers recommend temporarily removing h2 and h2c from the Protocols directive and leaving HTTP/1.1 enabled.
For example:
Protocols http/1.1
This is a temporary mitigation, not a permanent replacement for the security update.
Final Thoughts
The Apache HTTP/2 vulnerability is a serious reminder that outdated server software can create major security risks. Since the flaw may allow unauthenticated remote code execution, administrators should review their configurations and update affected systems quickly.
Keeping server software updated and regularly checking security advisories can help reduce the risk of future attacks.
