Apache HTTP Server mod_http2 RCE (CVE-2026-119618): upgrade to 2.4.71
Critical Apache HTTP Server flaw CVE-2026-119618 in mod_http2 allows remote code execution. Learn who is affected and how to fix it.
TL;DR: A critical remote code execution flaw, CVE-2026-119618, affects the HTTP/2 module (mod_http2) of Apache HTTP Server from 2.4.55 up to 2.4.70. Upgrade to 2.4.71, or turn HTTP/2 off until you can.
What happened
SecurityWeek and The Hacker News report that Apache has fixed a race condition in mod_http2. According to SecurityWeek, an unauthenticated attacker could use it to run code on a server that has HTTP/2 enabled. The Hacker News adds that the fix ships in version 2.4.71 and that, per Red Hat, only servers with HTTP/2 switched on are exposed.
The NVD entry classes the weakness as CWE-362, a shared resource used by concurrent code without proper synchronization. It also lists the standalone mod_h2 module from GitHub, from 2.0.8 up to 2.0.42, as affected.
Who should act first
Any internet-facing Apache server in the affected range with the http2 module loaded and the Protocols directive allowing h2 is the priority. Reverse proxies and container images that bundle Apache count too, because the version inside the image is what matters, not the host.
Distributions often backport fixes without changing the upstream version number, so check your vendor's advisory before concluding that a package is safe or vulnerable. If no patched package exists yet for your distribution, disabling HTTP/2 is the usual stopgap: remove h2 from the Protocols line and reload the server. Test that your site still works afterwards over the older protocol.
Am I affected?
On one machine, run apachectl -v (or httpd -v) to read the version, and apachectl -M | grep http2 to see whether the module is loaded. A version from 2.4.55 up to 2.4.70 with the module loaded is in scope. Across many servers, images and repositories, doing this by hand does not scale.
How to check with Stackurity
Stackurity keeps one live inventory of the software on your servers, container images and repositories, and matches it against new vulnerability advisories every hour. Apache HTTP Server found by the agent on Linux servers or in images is the kind of software it matches. Once you upgrade, it checks again and records whether the issue is really gone. See the remediation documentation for how upgrades are prioritised. Stackurity does not read your Apache configuration to tell whether HTTP/2 is enabled, so confirm that on each host.
Start a free trial of Stackurity to see which of your servers run an affected Apache.
Sources: NVD, SecurityWeek, The Hacker News.
