Critical Apache HTTP Server Flaw Exposes Web Servers to Unauthenticated Remote Code Execution

A critical security vulnerability affecting the Apache HTTP Server’s HTTP/2 module has been disclosed, presenting a severe risk to web infrastructure worldwide. Tracked under the identifier CVE-2026-119618, the flaw resides within the mod_http2 module and allows an unauthenticated remote attacker to execute arbitrary code on vulnerable servers, potentially granting full control over the underlying server process.

The security defect impacts Apache HTTP Server versions 2.4.55 through 2.4.70. The issue has been officially resolved in version 2.4.71, which was released following the coordinated disclosure. According to leading enterprise Linux vendor Red Hat, the vulnerability exclusively impacts web servers that have HTTP/2 functionality explicitly enabled within their configurations.

Given the severity of the flaw, security evaluators have assigned it a near-maximum base score of 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS). The assessment notes that any attacker capable of reaching the target server over the network can trigger the vulnerability without needing prior authentication. This low barrier to entry significantly elevates the urgency for system administrators to audit their server configurations and apply necessary software updates or workarounds.

Public assessments regarding the immediate exploit landscape have varied slightly among security organizations during the initial disclosure window. Red Hat’s security advisory noted that public research had demonstrated a reliable exploit against a server running in its default configuration with mod_http2 enabled, though specific research papers or links were not explicitly provided in their documentation. Conversely, cloud security firm Wiz reported later that same day that no active exploits were publicly available and that no instances of exploitation in the wild had been officially documented.

The vulnerability is tied directly to how the Apache HTTP Server handles HTTP/2 streams via the mod_http2 module. HTTP/2 operations are only active on servers where the Protocols directive has been explicitly configured to turn the protocol on. As outlined in the official module documentation, this directive utilizes the "h2" identifier for HTTP/2 traffic running over Transport Layer Security (TLS) and "h2c" for HTTP/2 operating over plain Transmission Control Protocol (TCP) connections. Because this directive can be applied globally at the server level or restricted to individual virtual hosts, system administrators are advised to thoroughly examine both their server-wide configurations and every deployed virtual host.

In addition to the primary Apache HTTP Server project releases, standalone builds of the module distributed via GitHub under the mod_h2 project are also affected. Specifically, versions 2.0.8 through 2.0.42 contain the vulnerable code. However, the standalone mod_h2 repository has remained read-only since it was archived on June 9, and the project has not published a patched release corresponding to this advisory.

Administrators running standard releases from the Apache HTTP Server project are strongly encouraged to upgrade immediately to version 2.4.71. Beyond resolving the critical remote code execution vulnerability, this specific release includes patches for two additional security issues. These include a server crash vulnerability in the mod_md module, rated as important, and a minor one-byte overwrite of stack memory within the mod_vhost_alias module, which carries a low severity rating.

Major Linux distributions and enterprise operating system vendors maintain their own independent packages and version numbering schemes, requiring administrators to consult specific vendor advisories. For instance, Red Hat released updates for Red Hat Enterprise Linux 9 and 10, categorizing the severity of the flaw as important rather than critical for their specific builds. According to Red Hat’s security documentation, their packaging of mod_http2 assigns each individual HTTP/2 stream its own distinct memory allocator, which substantially increases the complexity of mounting a successful exploit. Furthermore, older enterprise environments such as Red Hat Enterprise Linux 8 and earlier legacy editions do not contain the vulnerable codebase.

For Red Hat Enterprise Linux 9, the fix is made available via package mod_http2-2.0.26-7.el9_9.1, while Red Hat Enterprise Linux 10 receives its remediation through mod_http2-2.0.29-5.el10_3.1. Additional specialized releases, including Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions alongside Extended Update Support channels for versions 9.6, 9.8, 10.0, and 10.2, have also received corresponding security advisories and updated packages. However, Red Hat JBoss Core Services and Red Hat Hardened Images remain affected without a fully listed fix at the time of reporting.

Other major operating system ecosystems have experienced varying response timelines. Debian has addressed the vulnerability in its unstable distribution, commonly known as sid, by pushing version apache2 2.4.71-1. Meanwhile, Debian stable and testing releases including bookworm, trixie, and forky remain vulnerable while awaiting package backports. Amazon Linux distributions, spanning Amazon Linux 2, Amazon Linux 2023, and the Amazon Linux 2027 Preview, currently list the fix as pending across their tracking platforms. Ubuntu’s security tracker had not yet published a dedicated advisory page for the CVE at the time of initial checks.

Because the official Apache HTTP Server security advisory does not provide a direct software configuration workaround within the patch notes, security firms have stepped in with interim defensive recommendations. Wiz has advised system administrators who are temporarily unable to perform an immediate software upgrade to modify their server configurations. Specifically, administrators should remove both "h2" and "h2c" from the Protocols directive, restricting the server configuration solely to standard HTTP/1.1 traffic (Protocols http/1.1). This mitigation step applies equally to servers relying on standalone builds from the archived mod_h2 project.

The discovery of CVE-2026-119618 was the result of independent reporting channels. Anthropic’s OSS Scanner, a free automated scanning service utilized for open-source software security analysis powered by the company’s AI models, initially flagged the issue on October 26. Subsequent independent analysis and reporting were conducted last week by Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research.

This security event follows a historical trend of HTTP/2-related complications within the server software. An earlier critical HTTP/2 vulnerability, tracked as CVE-2026-23918, was patched earlier in the year on May 4 with the release of version 2.4.67. Web servers that were previously updated to that release, or to any subsequent version up to 2.4.70, continue to run code that leaves them exposed to the newly disclosed CVE-2026-119618 vulnerability, emphasizing the critical need for continuous patch management across modern web architectures.