Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

A critical vulnerability has been discovered in Apache HTTP Server's HTTP/2 module, potentially enabling unauthenticated attackers to execute code remotely on affected servers. This flaw, designated CVE-2026-119618, impacts versions 2.4.55 to 2.4.70 of Apache HTTP Server when HTTP/2 is enabled. The issue has been confirmed by public research demonstrating a reliable exploit against a server with the mod_http2 module enabled in its default configuration.

However, the Hacker News report does not specify or link to this research. Security firm Wiz stated later that day that no exploit had been made publicly available, and no exploitation incidents had been reported in the wild. HTTP/2 can be enabled for the entire server or for individual virtual hosts using the Protocols directive.

Administrators are advised to verify their server-wide HTTP/2 settings and check each virtual host configuration. The vulnerability affects standalone builds of the module, released as mod_h2 on GitHub, from version 2.0.8 through 2.0.42. Additionally, Apache HTTP Server's own releases should be updated to version 2.4.71, which addresses this vulnerability as well as other issues such as a crash in mod_md (rated important) and a one-byte stack memory overwrite in mod_vhost_alias (rated low).