CYBUNKR

Apache web server:critical HTTP/2 flaw, proof of concept already public

Published

CVE-2026-119618 in Apache HTTP Server 2.4.55 to 2.4.70 can let an attacker with no login run code on servers with HTTP/2 turned on. Proof-of-concept code is public. Update to 2.4.71.

Apache HTTP Server 2.4.71, released on 11 November, fixes CVE-2026-119618, a flaw the Apache project rates critical: a bug in its HTTP/2 module that can lead to remote code execution (Apache). No login is needed (Red Hat). Code that triggers the memory corruption was published the next day (googlesky on GitHub). If you or your web host run Apache, update now or turn HTTP/2 off.

Who is affected

  • Apache HTTP Server 2.4.55 to 2.4.70 and the standalone mod_h2 module 2.0.8 to 2.0.42 (Apache).
  • Only with HTTP/2 on. Servers that serve only HTTP/1.1 are not affected (Red Hat). HTTP/2 is turned on with h2 or h2c in the Protocols setting, which can be set server-wide or per site (Apache documentation).
  • Linux packages: Red Hat Enterprise Linux 9 and 10 have fixed packages and RHEL 8 and earlier are not affected (Red Hat). Debian 13 (trixie) is fixed in 2.4.71-1~deb13u1; Debian 12 (bookworm) was still listed as vulnerable (Debian).
  • Red Hat rates it 9.8 out of 10 and Critical, but Important on RHEL 9 and 10, where its build makes the attack much harder (Red Hat).
  • The same release fixes two lesser flaws with no known exploit: CVE-2026-106023 (important, a mod_md crash in 2.4.30 to 2.4.70) and CVE-2026-109163 (low, mod_vhost_alias in 2.4.69 and 2.4.70) (Apache).

What has been seen so far

A snapshot from 12 November:

  • Anthropic's OSS Scanner reported the flaw on 26 October, and Google Cloud Vulnerability Research reported it on 3 November (Apache, oss-security).
  • On 12 November a public GitHub project showed the bug corrupting memory in a real Apache 2.4.70 server and crashing it, and not on 2.4.71 (googlesky on GitHub). It shows crashes, not code being run.
  • Red Hat says public research has shown a reliable exploit against a default server with HTTP/2 on, but does not link it (Red Hat). On 11 November Wiz said no exploit was available and no attacks had been reported (Wiz). It is not in CISA's Known Exploited Vulnerabilities catalog.
  • Wiz says 51% of the cloud environments it sees have publicly exposed instances of an affected version, not counting whether HTTP/2 is on (Wiz).

What to do

  • Run Apache yourself? Update to 2.4.71, or install your Linux distribution's fixed package (Apache, Red Hat, Debian).
  • Can't update yet? Turn HTTP/2 off by removing h2 and h2c from every Protocols line (leaving Protocols http/1.1), then restart Apache (Wiz). Check the server-wide setting and every site.
  • Website on shared hosting or run by an agency? Ask your host or developer whether your server runs Apache with HTTP/2 and when it will be on 2.4.71.

How we can help

Not sure what your web server is running? Get in touch.

Sources