Critical Apache HTTP/2 flaw allows unauthenticated remote code execution
Servers running Apache 2.4.55 to 2.4.70 with HTTP/2 enabled should upgrade to 2.4.71, and the archived mod_h2 project has no fixed release.
A critical remote code execution flaw, tracked as CVE-2026-119618, has been found in the HTTP/2 module of Apache HTTP Server, affecting releases 2.4.55 through 2.4.70 and standalone mod_h2 builds from 2.0.8 through 2.0.42. Exploitation needs no credentials, and the defect only matters on servers where HTTP/2 is switched on, which is not the default. The Apache project fixed it in 2.4.71, and Red Hat rates it 9.8 on CVSS for its own packages, though it classes the flaw as Important on Enterprise Linux 9 and 10 thanks to per-stream memory allocation. Researchers at Wiz reported no public exploit or in-the-wild attacks when they published, although Red Hat cites public research claiming a reliable exploit it does not identify. Operators who cannot patch yet can drop h2 and h2c from the Protocols directive, and anyone running the archived mod_h2 project should note that no fixed release exists there.
Why it matters
The flaw is serious for the operators of any Apache server that has HTTP/2 switched on, since it needs no login and could hand an attacker control of the server process. Because HTTP/2 is not on by default, the exposure is limited to those who enabled it, and Red Hat rates the risk differently for its Enterprise Linux 9 and 10 packages. No public exploit or attacks had been seen when the flaw was published, but Red Hat cites research claiming a reliable exploit exists, so the window to patch is narrow. Operators who cannot update immediately can remove h2 and h2c from the Protocols directive, while anyone still relying on the archived mod_h2 project has no patch to apply.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.