CVE-2026-119618 — a critical bug in Apache HTTP Server's HTTP/2 module, mod_http2 — can let an unauthenticated remote attacker run code on affected servers, according to published advisories.
The vulnerability: CVE-2026-119618 and its impact
The flaw, tracked as CVE-2026-119618, affects Apache HTTP Server releases 2.4.55 through 2.4.70 and was fixed in version 2.4.71, released yesterday. The Linux vendor rates the flaw 9.8 out of 10 on the CVSS scale and warns that "an attacker who can reach the server needs no authentication to exploit the flaw and could take full control of the server process." The vendor's assessment also says "public research has demonstrated a reliable exploit" against a server running the default configuration with mod_http2 enabled.
Exactly which builds and modules are affected
Only servers with HTTP/2 enabled are affected. The Protocols directive controls whether HTTP/2 is active — using h2 for HTTP/2 over TLS and h2c for HTTP/2 over plain TCP — and can be set globally or per virtual host. Standalone builds of the module, published on GitHub as mod_h2, are affected from version 2.0.8 through 2.0.42. The Apache HTTP Server project's 2.4.71 release also addressed an important crash in mod_md and a low-rated one-byte stack overwrite in mod_vhost_alias.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogPatches, distribution fixes, and short-term mitigation options
Administrators running the Apache HTTP Server project's releases are instructed to move to 2.4.71, the fixed release named in the project's security advisory. Distributions ship their own builds with distinct package versions: for example, on Red Hat Enterprise Linux 9 the fix appears as mod_http2-2.0.26-7.el9_9.1. Red Hat shipped fixes for Red Hat Enterprise Linux 9 and 10 yesterday and, because their mod_http2 packages give each HTTP/2 stream its own memory allocator, rates the flaw Important on those releases rather than Critical. Red Hat Enterprise Linux 8 and earlier do not contain the vulnerable code.
The Apache advisory offers no workaround. Security company Wiz — cited in reporting — recommends that administrators who cannot update immediately remove h2 and h2c from the Protocols directive, leaving Protocols http/1.1 as a temporary mitigation. The standalone mod_h2 project has published no fixed release so far; its GitHub release list ends at 2.0.42 and the repository has been read-only since it was archived on June 9.
How the flaw was found and the current exploit picture
The flaw was first reported on October 26 by Anthropic's OSS Scanner, a free scanning service for open-source projects that uses the company's AI models. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported the issue last week. The vendor's own assessment refers to "public research" demonstrating a reliable exploit in a default configuration with mod_http2 enabled. Later the same day, security company Wiz said no exploit was available and that no exploitation in the wild had been reported.
What this means for system administrators, Red Hat, and operators using standalone mod_h2
- System administrators: Check every place the Protocols directive is set — server-wide and per virtual host — because HTTP/2 may be enabled in a single virtual host even when the global server is not. Apply the Apache project's 2.4.71 release where appropriate, or install your distribution's patched package.
- Red Hat and distribution maintainers: Red Hat has already shipped fixes for RHEL 9 and 10 and rated the flaw Important on those platforms due to per-stream memory allocation in their mod_http2 packages; administrators on those platforms should install the vendor-supplied updates (for example, mod_http2-2.0.26-7.el9_9.1 on RHEL 9).
- Operators using standalone mod_h2 builds: The standalone project has no fixed release and the repository has been archived, so operators relying on those builds should either remove HTTP/2 support by adjusting Protocols or migrate to a maintained Apache HTTP Server release that includes the 2.4.71 fix.
The technical facts are straightforward: a high-severity, unauthenticated remote code-execution flaw exists in mod_http2 builds shipped in common Apache 2.4 releases, a patch is available in 2.4.71, and some distributions have their own packaged fixes. The public record in the advisories contains a pointed divergence — the vendor's note that "public research has demonstrated a reliable exploit" versus Wiz's statement that no exploit is available and no in-the-wild exploitation has been observed — leaving administrators to weigh urgency against their environment's exposure and update cadence. In practice, the only complete remediation named in the advisory is to adopt the fixed releases or distribution packages; Apache offers no alternate workaround beyond the mitigations vendors and researchers have suggested.
