An urgent security flaw has been identified in the Apache HTTP Server’s HTTP/2 module, known as mod_http2, which could permit remote attackers to execute code on targeted servers. This vulnerability, labeled CVE-2026-119618, impacts versions 2.4.55 to 2.4.70. The issue has been resolved with the release of version 2.4.71, available since yesterday.
Affected Systems and Exploitation Risk
According to Red Hat, only systems with HTTP/2 enabled are vulnerable. Attackers can exploit this flaw without needing authentication, potentially gaining complete control over server processes. The vulnerability has been given a severity score of 9.8 out of 10 on the CVSS scale, underscoring its critical nature.
Despite claims of a reliable public exploit being available, no such exploit has surfaced yet, and there have been no reports of it being used in the wild. HTTP/2 functionality is activated using the Protocols directive, which can apply to an entire server or individual virtual hosts, making it essential for administrators to review these settings.
Mitigation and Patch Deployment
Administrators are urged to upgrade to version 2.4.71 of the Apache HTTP Server to mitigate the vulnerability. This update not only addresses the critical HTTP/2 flaw but also resolves other issues, such as a significant crash in mod_md and a minor memory overwrite in mod_vhost_alias.
Red Hat has released fixes for its Enterprise Linux versions 9 and 10, categorizing the flaw as Important rather than Critical due to mitigation measures that allocate separate memory for each HTTP/2 stream. Earlier versions of Red Hat Enterprise Linux do not contain the vulnerable code.
Current Status and Recommendations
Debian has patched its unstable branch, but other distributions like Debian bookworm and certain Amazon Linux versions remain vulnerable. Ubuntu has yet to provide a status update. Administrators unable to update immediately should remove HTTP/2 support by adjusting the Protocols directive to prevent potential exploitation.
Reported by Anthropic’s OSS Scanner and corroborated by cybersecurity experts from Google Cloud, this flaw follows a similar vulnerability identified earlier this year. As threats continue to evolve, timely updates and vigilant configuration management remain crucial in safeguarding web infrastructures.
