A critical flaw in the HTTP/2 module of Apache HTTP Server, mod_http2, can allow a remote attacker to run code on the affected server. The vulnerability is tracked as CVE-2026-119618.
Affected versions and fix
The flaw affects Apache HTTP Server versions 2.4.55 through 2.4.70. It is addressed in version 2.4.71, which was released recently. Organizations running earlier builds in this range should plan to upgrade promptly.
Who is exposed
Only servers with HTTP/2 enabled are affected, according to Red Hat, which distributes Apache HTTP Server as part of Red Hat Enterprise Linux. Servers that do not have the HTTP/2 module active are not exposed to this specific issue. Administrators should confirm whether HTTP/2 is enabled in their configurations before prioritizing remediation.
Attack scenario
According to the source reporting, an attacker who can reach a vulnerable server over the network may be able to trigger code execution remotely, without needing valid credentials. Because the attack does not require authentication, internet-facing servers with HTTP/2 enabled represent the highest-risk deployments.
Recommended actions
- Identify all Apache HTTP Server instances running versions 2.4.55 through 2.4.70.
- Verify whether the HTTP/2 module is enabled on each instance.
- Upgrade affected servers to version 2.4.71 or the fixed build supplied by your distribution vendor.
- Prioritize internet-facing servers, and review logs for unusual HTTP/2 traffic while patching is underway.
Given the critical rating and the unauthenticated nature of the flaw, patching should be treated as an urgent priority for any exposed Apache deployment.
