Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely Swati KhandelwalNov 12, 2026Vulnerability / Web Security A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday. Only servers with HTTP/2 enabled are affected, according to Red Hat, which ships the server as part of Red Hat Enterprise Linux. An attacker who can reach the server needs no authentication to exploit the flaw and could take full control of the server process, the Linux vendor says. It rates the flaw 9.8 out of 10 on the CVSS scale. The vendor's assessment, published yesterday, also says "public research has demonstrated a reliable exploit" against a server in its default configuration with mod_http2 enabled. It does not name or link that research. Security company Wiz said later that day that no exploit was available and that no exploitation in the wild had been reported. HTTP/2 runs only where the Protocols directive turns it on, as the module documentation explains. The directive uses h2 for HTTP/2 over TLS and h2c for HTTP/2 over plain TCP. It can be set for the whole server or for a single virtual host, so admins should check the server-wide setting and every virtual host. Standalone builds of the module, released on GitHub as mod_h2, are affected from version 2.0.8 through 2.0.42. Admins who run the Apache HTTP Server project's own releases should move to version 2.4.71, the fixed release named in its security advisory. That release also fixes a crash in mod_md, rated important, and a one-byte overwrite of stack memory in mod_vhost_alias, rated low. The distributions in the table below ship their own builds of the server, with their own package version numbers. On Red Hat Enterprise Linux 9, for example, the fix ships as mod_http2-2.0.26-7.el9_9.1. Red Hat shipped fixes for Red Hat Enterprise Linux 9 and 10 yesterday and rates the flaw Important on those releases rather than Critical. Their mod_http2 packages give each HTTP/2 stream its own memory allocator, which makes an attack much harder, according to the vendor's severity assessment. Red Hat Enterprise Linux 8 and earlier do not contain the vulnerable code. Apache HTTP Server project releases Fixed 2.4.71 Red Hat Enterprise Linux 9 Fixed (RHSA-2026:98981) mod_http2-2.0.26-7.el9_9.1 Red Hat Enterprise Linux 10 Fixed (RHSA-2026:98978) mod_http2-2.0.29-5.el10_3.1 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, and 9.6, 9.8, 10.0 and 10.2 Extended Update Support Fixed (RHSA-2026:98968, RHSA-2026:98954, RHSA-2026:98982, RHSA-2026:98953 and RHSA-2026:98979) See each advisory Red Hat Enterprise Linux 6, 7 and 8 Not affected None needed Red Hat JBoss Core Services and Red Hat Hardened Images Affected, no fix listed None listed Debian unstable (sid) Fixed apache2 2.4.71-1 Debian bookworm, trixie and forky Vulnerable None listed Amazon Linux 2 (Core), Amazon Linux 2023 and Amazon Linux 2027 Preview Pending fix None listed The Debian rows come from Debian's security tracker, and the Amazon row from the Amazon Linux tracker. Ubuntu's CVE tracker had no page for the flaw when The Hacker News checked it today. The Apache HTTP Server advisory offers no workaround. In its vulnerability analysis, Wiz advises admins who cannot update yet to remove h2 and h2c from the Protocols directive, leaving Protocols http/1.1. The standalone mod_h2 project has published no fixed release so far. Its release list on GitHub ends at 2.0.42, the last affected version, and its repository has been read-only since it was archived on June 9. The Protocols change above also applies to servers that use those builds. The flaw was reported on October 26 by Anthropic's OSS Scanner, a free scanning service for open-source projects that uses the company's AI models. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported it last week. An earlier HTTP/2 flaw, CVE-2026-23918, was fixed in version 2.4.67, released on May 4. Servers updated to that release, or to any later one up to 2.4.70, still run a version that the new flaw affects. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. artificial intelligence, linux, Vulnerability, Web Security Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out The Flood is Coming And The Pipes Were Already Full OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Secure My Spot Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Uncover Identity Dark Matter: SACR Research Brief Eliminate the blind spots undermining your security. Download the SACR brief. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk