Critical HTTP/2 Vulnerability Fixed in Apache Server 2.4.71
Original source
Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
The Hacker News →A critical remote code execution vulnerability in Apache HTTP Server’s HTTP/2 module (CVE-2026-119618) affects versions 2.4.55 through 2.4.70 and was patched in version 2.4.71. Unauthenticated attackers can exploit this flaw on servers with HTTP/2 enabled via the Protocols directive, and it carries a CVSS score of 9.8.
Red Hat’s advisory stated that public research has demonstrated a reliable exploit, but security firm Wiz contradicted this claim, saying no exploit is publicly available and no attacks have been observed in the wild. The vulnerability also affects standalone mod_h2 versions 2.0.8-2.0.42, but the project has not released a patch and its repository is now read-only.
Server administrators can either upgrade to version 2.4.71 or temporarily mitigate the issue by disabling HTTP/2 in the Protocols directive. Red Hat Enterprise Linux rates the flaw Important rather than Critical because their builds assign separate memory allocators to each HTTP/2 stream. Anthropic’s OSS Scanner discovered the vulnerability on October 26, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported it.
Read the full article
Continue reading at The Hacker News →This is an AI-generated summary. Read the original for the full story.