Skip to main content
Published on November 13, 2026
CVE-2026-119618 — Apache HTTP Server, mod_http2 module. Apache rates this flaw critical. It is remotely exploitable, with no authentication, on any Apache server that serves HTTP/2. If that is you, apply your distribution’s update today.

The bug in two sentences

The assign_headers() function in mod_http2 touches a resource shared between threads without proper synchronization. A crafted HTTP/2 request can corrupt the server’s heap and lead to code execution with the privileges of the Apache process. Affected versions:
  • Apache HTTP Server 2.4.55 through 2.4.70, fixed in 2.4.71 (released November 11, 2026);
  • mod_h2 from GitHub, versions 2.0.8 through 2.0.42.
Scores vary by vendor: 8.1 in the score published on cve.org and NVD (high attack complexity), 9.8 from Red Hat. Ubuntu rates it high priority.
At the time of writing, there is no public exploit and no report of active exploitation. The flaw was found independently by Anthropic’s OSS Scanner and by Google Cloud’s Vulnerability Research team.

Sizing your exposure

The question to ask: does your Apache speak HTTP/2? Only servers whose Protocols directive includes h2 or h2c are exposed. A server that only serves HTTP/1.1 is not. To check whether HTTP/2 is enabled:
An active Protocols line containing h2 or h2c means HTTP/2 is on.
Don’t rely on the Apache version number alone. Distributions backport newer mod_http2 releases: Ubuntu 22.04 ships Apache 2.4.52 and is still on the affected list. Your distribution’s advisory is the reference.

Updating, distro by distro

The real fix is a package update followed by an Apache restart.

Debian

Ubuntu

Advisory: USN-9090-1, November 12, 2026.

RHEL, AlmaLinux, Rocky Linux

Red Hat lists RHEL 9 and RHEL 10 as affected. On these releases, mod_http2 ships as a separate package from httpd: update both.
Compare the output with your distribution’s security advisory before marking the server as fixed.

Mitigation until you can patch

If you can’t update right away, Red Hat recommends disabling HTTP/2: remove h2 and h2c from every Protocols directive and keep HTTP/1.1 only. Clients fall back to HTTP/1.1 on their own.
Make the change in every file where Protocols appears (global configuration and virtual hosts), then restart:

Verifying the mitigation

  • first line HTTP/1.1 200 OK: HTTP/2 is disabled;
  • first line HTTP/2 200: HTTP/2 is still on.
Run the grep from “Sizing your exposure” again as well: no active Protocols line should contain h2 or h2c.

Re-enabling HTTP/2 after the update

Once the fixed package is installed, you can bring HTTP/2 back:

What next?

Disabling HTTP/2 is a stopgap: the target is your distribution’s fixed package. For any technical question, open a ticket from your OnetSolutions customer area.