A critical vulnerability in Apache HTTP Server’s HTTP/2 module, known as mod_http2, could allow unauthenticated attackers to execute arbitrary code on affected servers. The flaw, identified as CVE‑2026‑119618, is present in Apache releases 2.4.55 through 2.4.70.
Red Hat confirmed that only servers with HTTP/2 enabled are at risk. The company distributes the vulnerable server as part of its Red Hat Enterprise Linux distribution.
The issue has been addressed in Apache HTTP Server version 2.4.71, which was released yesterday. Administrators are urged to upgrade to the patched version immediately to mitigate the risk.
- Vulnerable versions: 2.4.55 – 2.4.70
- Fixed in: 2.4.71
- Affected only when HTTP/2 is enabled
While the source material does not detail the exact exploitation method, the vulnerability’s severity is clear: it permits remote code execution without authentication. Users of Apache HTTP Server should verify their configuration and apply the update as soon as possible.
<small>Source: The Hacker News — read the original story there.</small>
