Apache mod_http2 Critical Vulnerability (CVE-2026-119618): Can RCE Without Login, Update to 2.4.71

CVE-2026-119618 is a critical vulnerability in the Apache HTTP Server HTTP/2 (mod_http2) module that could corrupt memory and lead to remote code execution (RCE) without login. The affected versions are 2.4.55 to 2.4.70 with HTTP/2 enabled, and the fix is ​​in Apache 2.4.71 which is released November 11, 2026.

Apache is still the main web server in many hosting, cPanel and VPS panels in Indonesia, so this gap touches many admins. As of November 12, 2026, there have been no reports of exploitation in the wild, but distro repair packages have not been distributed evenly. This article discusses how the loophole works, who is affected, patch status per distro, how to check, temporary mitigation, and update steps.

Quick summary

How does this mod_http2 loophole work?

This vulnerability occurs because two execution paths in mod_http2 access the same memory at the same time without sufficient locking. Apache calls its location in function assign_headers(). Race conditions can damage the heap, and heap damage is the door to code execution.

What are the conditions for the attack?

There are only two conditions: the Apache version is in the affected range and HTTP/2 is active. Apache's advisory does not mention a login requirement or other prerequisites. An attacker can simply send an HTTP/2 request to the server. Full technical details have not been published, and this article intentionally does not cover how to exploit it.

Who is affected?

Affected are Apache servers 2.4.55 through 2.4.70 that contain mod_http2 and advertise protocol h2 or h2c.

• VPS and HTTP/2 enabled servers on Apache, both globally and per virtual host.
• A cPanel server with EasyApache 4 with package ea-apache24-mod_http2 installed.
• RHEL 9 and 10, AlmaLinux, CloudLinux 9 and 10 with mod_http2 system packages.
• Debian bookworm and trixie with mod_http2 on.
• Server that uses mod_h2 standalone from GitHub versions 2.0.8 to 2.0.42.

Not affected: servers that only serve HTTP/1.1, Apache below 2.4.55, and RHEL 6, 7, and 8. Servers that have upgraded to 2.4.67 to 2.4.70 to patch CVE-2026-23918 last May are still affected by this new vulnerability.

How serious is this loophole?

Seriously, because of the impact of RCE without logging in on a web server that is open to the internet, while distro repair packages are not evenly available.

• Apache rated critical. This is the highest level on the Apache project severity scale.
• Red Hat rated CVSS 9.8. For RHEL 9 and 10, Red Hat lowered the impact to Important because the way memory is allocated there makes attacks much more difficult.
• No actual attacks have been reported yet. However, Red Hat notes that public research has shown reliable exploits in default configurations with mod_http2 enabled. The distance to a mass attack can be short.
• There is no official workaround from Apache. Turning off HTTP/2 is a mitigation that distro vendors and researchers recommend.
• Release 2.4.71 also patches CVE-2026-106023 (mod_md, important) and CVE-2026-109163 (mod_vhost_alias, low).

Which version is safe?

The secure upstream version is Apache HTTP Server 2.4.71. For distro packages, what matters is the package revision, not the Apache version number. Status as of November 12, 2026:

How do I check if my server is affected?

Check two things: Apache version and whether mod_http2 is loaded. The following script is read only and its logic has been sandbox tested with mock output.

#!/bin/sh
# Cek paparan CVE-2026-119618 di Apache HTTP Server. Hanya membaca.
CTL=$(command -v apache2ctl || command -v apachectl || command -v httpd)
[ -z "$CTL" ] && { echo "Apache tidak ditemukan"; exit 0; }
ver=$($CTL -v 2>/dev/null | sed -n 's/.*Apache\/\([0-9.]*\).*/\1/p')
echo "Versi Apache : ${ver:-tidak terbaca}"
if $CTL -M 2>/dev/null | grep -q 'http2_module'; then h2=ya; else h2=tidak; fi
echo "mod_http2    : $h2"
patch=$(echo "$ver" | cut -d. -f3)
if [ "$h2" = "ya" ] && [ "${patch:-0}" -ge 55 ] && [ "${patch:-0}" -le 70 ]; then
  echo "HASIL: versi upstream rentan dan HTTP/2 aktif. Cek changelog paket distro, lalu update."
else
  echo "HASIL: kombinasi rentan (2.4.55-2.4.70 + mod_http2) tidak terdeteksi."
fi

On distros that backport fixes, Apache version numbers can remain old. Verify via the package changelog, then check externally to see if the server still offers HTTP/2:

# RHEL, AlmaLinux, CloudLinux 9/10
rpm -q --changelog mod_http2 | grep CVE-2026-119618

# cPanel EasyApache 4
rpm -q ea-apache24-mod_http2

# dari luar: "2" berarti HTTP/2 masih aktif, "1.1" berarti tidak
curl -sI --http2 -o /dev/null -w '%{http_version}\n' https://domain-anda.com

How to update safely?

Safe order: disable HTTP/2 as a mitigation, install the fix package once it's available, then re-enable HTTP/2 once verified.

Step 1: mitigate by turning off HTTP/2

Turning off HTTP/2 closes the attack path because mod_http2 is no longer used. The site continues to run over HTTP/1.1, with possible slight performance degradation on pages containing many files.

# Debian / Ubuntu
a2dismod http2 && apache2ctl configtest && systemctl restart apache2

# RHEL / AlmaLinux / CloudLinux 9-10:
# beri komentar baris LoadModule http2_module di /etc/httpd/conf.modules.d/10-h2.conf
apachectl configtest && systemctl restart httpd

# cPanel EasyApache 4 (AlmaLinux / CloudLinux)
dnf remove ea-apache24-mod_http2 && /scripts/restartsrv_httpd

Alternatively, set Protocols http/1.1 in the global configuration and on each virtual host call h2 or h2c. Search first with grep -rn "Protocols" /etc/apache2 /etc/httpd 2>/dev/null. On Ubuntu-based cPanel, use apt-get purge for the module package, because remove leaves configuration files that make Apache fail to start.

Step 2: update and verify

# RHEL / AlmaLinux / CloudLinux 9-10
dnf clean metadata && dnf update mod_http2 && systemctl restart httpd
rpm -q --changelog mod_http2 | grep CVE-2026-119618

# Debian / Ubuntu (setelah paket perbaikan tersedia)
apt update && apt install --only-upgrade apache2 && systemctl restart apache2
a2enmod http2 && systemctl restart apache2

Once the fix package is installed, re-enable HTTP/2 and test with command curl above. If compiling from source, download 2.4.71 from the official Apache site and verify the signature.

How to detect attempted attacks?

There is no official indicator of attack (IOC) for this gap yet. What can be monitored are symptoms of memory corruption, namely Apache child processes that die unexpectedly:

# proses anak yang crash (Debian/Ubuntu: /var/log/apache2, RHEL: /var/log/httpd)
grep -hE "AH00051|AH00052|exit signal|Segmentation fault" /var/log/apache2/error.log* /var/log/httpd/error_log* 2>/dev/null | tail -n 30

# crash yang tercatat kernel
journalctl -k --since "2026-11-01" | grep -iE "apache2|httpd" | grep -iE "segfault|general protection"

Occasional crashes can have many other causes. What is suspicious is the spike in crashes on servers that have HTTP/2 active and have not been patched.

If you find signs of a burglary?

1. Turn off HTTP/2 immediately and limit access to the server while investigating.
2. Check for processes belonging to the Apache user ( www-data, apache, or nobody), new files in the web directory and /tmp, and the user's cron.
3. Rotation of credentials that web processes can read: database passwords, API keys, and files .env.
4. Restore from a clean backup or rebuild the server, then install the patched version before reopening.

Frequently asked questions

Is Nginx or LiteSpeed ​​affected?

No. CVE-2026-119618 is in the mod_http2 code of the Apache HTTP Server. Other web servers have their own HTTP/2 implementations.

My Apache is behind Cloudflare or a reverse proxy. Still at risk?

The risk is smaller if the connection from the proxy to Apache uses HTTP/1.1 and Apache cannot be reached directly from the internet. If the server's original IP is still open and HTTP/2 is active, the server can still be attacked. Keep updating.

Does turning off HTTP/2 make a site slow?

The site continues to function normally via HTTP/1.1. Pages with lots of small assets can feel a little slower. For the time being, that's a reasonable price compared to RCE's risk.

My Apache version is 2.4.62 from the distro package. Vulnerable or not?

It cannot necessarily be inferred from the version number. Distros often backport fixes without upgrading. Check your distro's package changelog or security tracking page for CVE-2026-119618.

Has this loophole been exploited?

As of November 12, 2026 there have been no reports of exploitation in the wild and this loophole has not yet entered CISA KEV. But public research has shown reliable exploits, so don't wait.

Other server vulnerabilities you need to check this week: the OpenSSH sshole vulnerability in Alpine Linux, the WordPress update vulnerability CVE-2026-119977, and the Git vulnerability CVE-2026-111760.

Source

• Apache HTTP Server 2.4 vulnerabilities: release 2.4.71 (November 11, 2026)
• CloudLinux: Critical Apache mod_http2 flaw CVE-2026-119618
• The Hacker News: Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
• SecurityOnline: Apache HTTP Server Remote Code Execution Fixed in 2.4.71