> ## Documentation Index
> Fetch the complete documentation index at: https://blog.onetsolutions.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Apache HTTP/2 (CVE-2026-119618): Remote Code Execution in mod_http2

> A race condition in mod_http2 enables remote code execution on Apache 2.4.55 to 2.4.70. Exposure, per-distro fixes, and mitigation.

*Published on November 13, 2026*

> [!WARNING]
>
> **CVE-2026-119618 — Apache HTTP Server, mod\_http2 module.** Apache rates this flaw critical. It is remotely exploitable, with no authentication, on any Apache server that serves HTTP/2. If that is you, apply your distribution's update today.

## The bug in two sentences

The `assign_headers()` function in **mod\_http2** touches a resource shared between threads without proper synchronization. A crafted HTTP/2 request can corrupt the server's heap and lead to code execution with the privileges of the Apache process.

Affected versions:

* **Apache HTTP Server 2.4.55 through 2.4.70**, fixed in **2.4.71** (released November 11, 2026);
* **mod\_h2** from GitHub, versions 2.0.8 through 2.0.42.

Scores vary by vendor: 8.1 in the score published on cve.org and NVD (high attack complexity), 9.8 from Red Hat. Ubuntu rates it high priority.

> [!NOTE]
>
> At the time of writing, there is no public exploit and no report of active exploitation. The flaw was found independently by Anthropic's OSS Scanner and by Google Cloud's Vulnerability Research team.

## Sizing your exposure

The question to ask: **does your Apache speak HTTP/2?** Only servers whose `Protocols` directive includes `h2` or `h2c` are exposed. A server that only serves HTTP/1.1 is not.

| Profile | Exposure | Action |
| - | - | - |
| Apache with HTTP/2 enabled (`h2` or `h2c`), reachable from the Internet | **Critical** | Update today; if you can't, disable HTTP/2 in the meantime |
| Apache with HTTP/2 enabled, internal access only | High | Update promptly |
| Apache serving HTTP/1.1 only | Not exposed | Update at your next maintenance window |
| RHEL 8, AlmaLinux 8, Rocky Linux 8; Ubuntu 18.04 and older | Not affected | Nothing to do |

To check whether HTTP/2 is enabled:

```bash theme={null}
# Debian, Ubuntu
grep -ri 'Protocols' /etc/apache2/ 2>/dev/null

# RHEL, AlmaLinux, Rocky Linux
grep -r 'Protocols' /etc/httpd/conf/ /etc/httpd/conf.d/ 2>/dev/null
grep http2 /etc/httpd/conf.modules.d/*.conf
```

An active `Protocols` line containing `h2` or `h2c` means HTTP/2 is on.

> [!NOTE]
>
> Don't rely on the Apache version number alone. Distributions backport newer mod\_http2 releases: Ubuntu 22.04 ships Apache 2.4.52 and is still on the affected list. Your distribution's advisory is the reference.

## Updating, distro by distro

The real fix is a package update followed by an Apache restart.

### Debian

| Release | Fixed `apache2` package | Advisory |
| - | - | - |
| Debian 13 (trixie) | `2.4.71-1~deb13u1` | DSA-6620-1 |
| Debian 12 (bookworm) | `2.4.71-1~deb12u1` | DLA-4902-1 |

### Ubuntu

| Release | Fixed `apache2` package |
| - | - |
| 26.10 | `2.4.68-1ubuntu6.2` |
| 26.04 LTS | `2.4.66-2ubuntu2.8` |
| 24.04 LTS | `2.4.58-1ubuntu8.19` |
| 22.04 LTS | `2.4.52-1ubuntu4.27` |
| 20.04 LTS | `2.4.41-4ubuntu3.23+esm11` (Ubuntu Pro) |

Advisory: USN-9090-1, November 12, 2026.

```bash theme={null}
# Debian, Ubuntu: install the fix, then restart Apache
sudo apt update
sudo apt install --only-upgrade apache2
sudo systemctl restart apache2

# Check the installed version
dpkg -l apache2 | grep ^ii
```

### RHEL, AlmaLinux, Rocky Linux

Red Hat lists RHEL 9 and RHEL 10 as affected. On these releases, **mod\_http2 ships as a separate package** from `httpd`: update both.

```bash theme={null}
sudo dnf upgrade httpd mod_http2
sudo systemctl restart httpd

# Check the installed versions
rpm -q httpd mod_http2
```

Compare the output with your distribution's security advisory before marking the server as fixed.

## Mitigation until you can patch

If you can't update right away, Red Hat recommends disabling HTTP/2: remove `h2` and `h2c` from every `Protocols` directive and keep HTTP/1.1 only. Clients fall back to HTTP/1.1 on their own.

```apache theme={null}
# Before
Protocols h2 h2c http/1.1

# After
Protocols http/1.1
```

Make the change in every file where `Protocols` appears (global configuration and virtual hosts), then restart:

```bash theme={null}
# Debian, Ubuntu
sudo apache2ctl configtest && sudo systemctl restart apache2

# RHEL, AlmaLinux, Rocky Linux
sudo apachectl configtest && sudo systemctl restart httpd
```

## Verifying the mitigation

```bash theme={null}
curl -kI --http2 https://localhost
```

* first line `HTTP/1.1 200 OK`: HTTP/2 is disabled;
* first line `HTTP/2 200`: HTTP/2 is still on.

Run the `grep` from "Sizing your exposure" again as well: no active `Protocols` line should contain `h2` or `h2c`.

## Re-enabling HTTP/2 after the update

Once the fixed package is installed, you can bring HTTP/2 back:

```apache theme={null}
Protocols h2 http/1.1
```

```bash theme={null}
# Debian, Ubuntu
sudo apache2ctl configtest && sudo systemctl restart apache2

# RHEL, AlmaLinux, Rocky Linux
sudo apachectl configtest && sudo systemctl restart httpd
```

## What next?

Disabling HTTP/2 is a stopgap: the target is your distribution's fixed package. For any technical question, open a ticket from your [OnetSolutions customer area](https://help.onetsolutions.net/console/support).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.