Apache fixed a critical remote code execution vulnerability in the mod_http2 module in version 2.4.71. It affects Apache HTTP Server versions 2.4.55 through 2.4.70, but the described risk requires HTTP/2 to be enabled; standalone mod_h2 builds from 2.0.8 to 2.0.42 are also affected. If you administer a web server, check both before deciding on next steps.
First, check whether your server is in the affected range
The flaw, identified as CVE-2026-119618, is in assign_headers() in mod_http2. A race condition can corrupt server memory and allow an unauthenticated attacker to execute code with the privileges of the web process. Knowing that the server uses Apache is not enough: you need to confirm the version and whether HTTP/2 is active.
The Apache project advisory sets the affected range at versions 2.4.55 through 2.4.70. INCIBE also includes versions 2.0.8 through 2.0.42 of the standalone mod_h2 module. Version 2.4.71 fixes this flaw and two other security issues, one in mod_md and another in mod_vhost_alias.
| Installation | Affected range | Recommended action |
|---|---|---|
| Apache HTTP Server with mod_http2 | 2.4.55–2.4.70 | Update to 2.4.71 or later |
| Standalone mod_h2 | 2.0.8–2.0.42 | Install a vendor update that includes the fix |
The HTTP/2 condition matters: the Protocols directive can enable it as h2 over TLS or h2c over unencrypted TCP. The Apache project specifies the version range; INCIBE recommends updating to 2.4.71 or later and, for mod_h2 distributed separately, applying the vendor update.
What to do, in order
Identify which server hosts your sites. Check whether Apache HTTP Server is part of the infrastructure you administer or is managed by your hosting provider. If you do not have access to the server or its configuration, ask the responsible team for the installed version, whether mod_http2 is enabled, and when it will apply the fix. Apache is the software that serves web pages and other content; do not assume your site uses it without confirming.
Verify the installed version. Compare the Apache HTTP Server version with the affected range: 2.4.55 through 2.4.70, inclusive. If you manage the software as a distribution package or managed service, confirm with the provider which fixed version it includes; the visible version number alone may not describe how the fix is distributed. If you use mod_h2 separately, also check whether its version is between 2.0.8 and 2.0.42.
Check whether HTTP/2 is enabled. Examine Apache's effective configuration for the
Protocolsdirective and theh2orh2cvalues. The configuration may apply to the entire server or to a specific virtual host, so check both levels and every active virtual host. Apache notes that HTTP/2 is disabled by default in the configuration described, but do not assume it remains disabled in your installation.Update to Apache 2.4.71 or later. This is the measure recommended by INCIBE for Apache HTTP Server. If you cannot install that version directly because you receive Apache through a provider, request an update that includes the CVE-2026-119618 fix and verify that it has been applied. For installations with standalone mod_h2, follow the update published by that module's provider.
Reduce the risk while you wait. If you cannot update immediately and HTTP/2 is not necessary, temporarily disable mod_http2 and proxy_http2, or remove HTTP/2 negotiation, so that traffic is served only over HTTP/1.1. watchTowr summarized its recommendation as follows: “Patch now or drop h2 until you can”. Do not disable HTTP/2 without first checking which sites or services depend on it.
Verify the result of the change. After updating or removing HTTP/2, check the version and effective configuration again, including the virtual hosts. If a provider made the change, ask them to confirm that the specific instance has been fixed or that HTTP/2 has been disabled. Protection depends on the installation handling the requests, not just on an update being available.
Patch now or drop h2 until you can
— watchTowr researchers
Mistakes to avoid
Do not confuse a vulnerable version with confirmed exposure. The flaw affects the specified range, but the described condition requires HTTP/2 to be enabled. Conversely, the fact that you did not consciously enable HTTP/2 does not prove it is disabled: check the Protocols directive and the configuration of each virtual host.
Do not rely on an aggregate figure alone. Wiz found vulnerable resources in 64% of the cloud environments it analyzed, and approximately half of those resources were publicly accessible. That figure does not determine whether your server is exposed: it does not account for the HTTP/2 configuration of each installation.
Do not delay the fix because there are no known attacks. Wiz said it was not aware of public exploits or attacks targeting this flaw, but Apache said that public research had demonstrated a reliable exploit against a server with mod_http2 active in its default configuration. The practical priority is to update; disabling HTTP/2 is a temporary measure when you cannot do so immediately.
Do not forget additional modules. Version 2.4.71 also fixes CVE-2026-106023 in mod_md and CVE-2026-109163 in mod_vhost_alias. INCIBE notes that these modules have their own affected ranges; keeping Apache on a fixed version also addresses those issues described in the advisory.
The Apache HTTP Server fix was published on November 11, 2026. If your installation is still in the affected range, the outstanding check is straightforward: confirm whether HTTP/2 is active and apply the relevant update or temporarily disable it.
Sources: Hardware Upgrade, BleepingComputer, incibe.es, The Apache HTTP Server Project, Red Hat
