Apache HTTP Server: critical flaw in mod_http2 (CVE-2026-119618)
A critical flaw, CVE-2026-119618, has been found in the mod_http2 module of Apache HTTP Server. It can let a remote attacker run code on the server. A fix is available in version 2.4.71.
Checked in Shield: no
Who is affected
Apache HTTP Server 2.4.55 through 2.4.70 is affected, and only servers with HTTP/2 enabled, according to Red Hat.
How to check
Check your version with httpd -v (or apache2 -v). See whether the module is loaded with apachectl -M | grep http2 and whether the h2 protocol is enabled in your configuration.
How to fix
Update Apache HTTP Server to version 2.4.71. If you use a distribution package, such as on RHEL, watch for package updates from the vendor.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Exploitation status and technical attack details are not disclosed yet. Source: The Hacker News.
