{
  "id": 19605327,
  "title": "Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely",
  "url": "https://urgent.news/2026/11/12/critical-apache-http-2-flaw-could-let-unauthenticated-attackers",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-12T05:12:26.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html"
  },
  "original_language": "en",
  "account": "A flaw in Apache HTTP Server's HTTP/2 module, CVE-2026-119618, could enable remote attackers to execute code on vulnerable servers. The vulnerability affects versions 2.4.55 through 2.4.70 and is resolved in version 2.4.71. Only servers with HTTP/2 enabled are impacted. Unauthenticated attackers can exploit the flaw and take full control of the server process. This critical vulnerability rates 9.8 out of 10 on the CVSS scale. Red Hat, which ships the server with Red Hat Enterprise Linux, rates the flaw Important rather than Critical in the latest release. No exploit is currently available, but public research has demonstrated a reliable attack against a server in its default configuration. Administrators should verify their server-wide settings and virtual host configurations to ensure HTTP/2 is not enabled. The flaw was reported by Anthropic's OSS Scanner and Google Cloud Vulnerability Research.",
  "summary": "A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday. Only servers with HTTP/2 enabled are affected, according to Red Hat, which ships the server as part of Red Hat Enterprise Linux. An attacker who can reach the",
  "key_points": [
    "Apache HTTP/2 module has critical flaw CVE-2026-119618",
    "Unauthenticated attackers can remotely execute code on vulnerable servers",
    "Red Hat rates the flaw Important, not Critical"
  ],
  "editors_take": "The severity of this flaw forces administrators to reevaluate the security risks of enabling HTTP/2, as unauthenticated attackers can gain full control of vulnerable server processes.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}