Apache Fixes a Critical HTTP/2 Code Execution Flaw
Apache HTTP Server 2.4.71 fixes a critical flaw in its HTTP/2 module. A race while the module handles request headers can corrupt memory and let a remote attacker run code in the server process. Start with internet-facing servers and reverse proxies that use Apache for HTTP/2. CVE-2026-119618 · Apache’s security advisory
Check the module as well as the server
Apache lists upstream HTTP Server 2.4.55 through 2.4.70 as affected. It also lists standalone mod_h2 releases 2.0.8 through 2.0.42. If a distribution or hosting panel ships the module separately, match that package to the supplier’s advisory. Check whether Apache itself handles HTTP/2 on public and internal listener paths, including connections from a load balancer to the origin. Apache’s affected versions
The same release also fixes a request-handling crash in mod_md and a one-byte stack overwrite in mod_vhost_alias. Check the package provider’s guidance for all three fixes. CVE-2026-106023 · CVE-2026-109163 · Apache’s 2.4.71 release
Verify the running server after updating
Apply the upstream release or the distribution’s fixed package. Restart the service using the package provider’s instructions, verify the running package and module, and test a representative request through each relevant proxy path. Check container images and standby instances separately so the next deployment or failover uses the fixed code.
Update, 12 November 2026
Ubuntu published fixed packages for its supported releases. Red Hat confirmed that mod_http2 ships separately on RHEL 9 and 10 and published its own product-specific patch and mitigation guidance. Ubuntu’s tracker also documents module backports into stable releases. Check the distribution’s package record before ruling out an older-looking server version. Ubuntu security notice · Ubuntu package tracker · Red Hat bulletin
