Apache HTTP Server bug exposes HTTP/2 deployments to unauthenticated code execution

Key points

• CVE-2026-119618 affects Apache HTTP Server builds 2.4.55 through 2.4.70 when HTTP/2 is enabled.
• An unauthenticated remote party can achieve code execution; the vendor rating is critical.
• Red Hat RHEL deployments using affected packages need vendor patches or a move to 2.4.71.
• A corrected release was available one day before the November 2026 disclosure.

In November 2026, details emerged about CVE-2026-119618, a flaw in the Apache HTTP Server's mod_http2 component. This defect impacts setups using builds 2.4.55 to 2.4.70 when HTTP/2 is turned on. Apache and Red Hat are both named in the issue, and Red Hat Enterprise Linux environments that carry the affected server are in scope for review. A corrected release, 2.4.71, was published the day before the disclosure.

Exploitation does not require an account or any prior foothold. An outside attacker can reach the service over the network and, if the target is vulnerable, run code on the host. The vendor rates the issue as critical, and the combination of no authentication requirement and code execution makes it a serious unauthenticated compromise path. Internet-facing web front ends are the most obvious exposure point.

For K-12 and government operations, the practical risk is concentrated in public-facing portals, reverse proxies, and web gateways that terminate HTTP/2. A compromised web server can become a pivot into internal services, so the issue matters beyond the individual host. The affected version range is broad enough that older but still-supported deployments may be caught if they have not tracked recent updates.

Administrators should inventory Apache HTTP Server instances, confirm whether mod_http2 and HTTP/2 are active, and move to 2.4.71. Where an immediate upgrade is not possible, apply Red Hat's patched packages or temporarily disable HTTP/2 as a containment measure. After patching, review logs for unusual HTTP/2 requests, server crashes, unexpected child processes, and outbound connections from web hosts. Watch vendor advisories for RHEL backports and recheck exposure after maintenance windows.

What to do now

1. Inventory all internet-facing Apache HTTP Server instances and identify builds 2.4.55 through 2.4.70 with mod_http2 or HTTP/2 enabled.
2. Move to 2.4.71 immediately on affected hosts; if that cannot happen, apply Red Hat vendor patches or disable HTTP/2 as a temporary containment step.
3. Place web servers behind a WAF or VPN where feasible, and rate-limit or inspect HTTP/2 traffic until patching is complete.
4. Hunt logs for anomalous HTTP/2 requests, server crashes, unexpected child processes, and outbound connections from web hosts.
5. Rotate secrets and credentials on any host with signs of compromise, isolate it, and rebuild from a known-good image if needed.
6. Verify patch levels after maintenance and monitor Red Hat advisories for RHEL package updates and backports.

CVE references

• CVE-2026-119618

Original source

The Hacker News