CVE-2026-119618: Apache fixes critical HTTP/2 flaw

Apache released HTTP Server 2.4.71 on 11 November 2026. The update fixes CVE-2026-119618, a critical vulnerability in the mod_http2 HTTP/2 module that can enable remote code execution. Apache security advisory

Operators need to establish two things: whether their installed package is affected, and whether that Apache service accepts HTTP/2 connections. An installed module alone does not answer the second question.

Which Apache versions are affected?

Apache describes improper synchronisation of shared memory in assign_headers(). The advisory documents affected ranges and the fix. If mod_h2 was integrated separately, include its origin and version in the assessment.

HTTP/2 configuration and distribution matter

According to Red Hat, authentication is not required. Servers enabling h2 or h2c are affected; HTTP/1.1-only operation is not vulnerable to this CVE. Red Hat also reports publicly demonstrated exploitation.

Severity varies by product. Different memory allocation makes RHEL 9 and 10 “Important”; RHEL 8 and earlier are unaffected, according to Red Hat. Distributors may also backport fixes to older packages. A lower Apache version number alone therefore does not prove exposure: check the security advisory for the actual package. Red Hat assessment

What to collect for the inventory check

Our operational recommendation is to inspect the running instance, including containers and customer-specific installations. A shared base image can help identify a group of potentially affected servers. It does not establish that every running instance has already been replaced.

Apache provides read-only diagnostic options:

httpd -v
httpd -M
httpd -S

These display the version, loaded modules and virtual-host configuration. The executable or management command may differ by distribution and require the appropriate service environment. The Apache documentation explains these options. Run checks against the relevant installation rather than accidentally inspecting a different binary on the host.

Record the package source, complete package version, owner and service alongside the finding. This ties a pending update to a specific system. An asset inventory is particularly useful where several teams or providers operate web servers.

Apply the update or temporarily limit HTTP/2

The corrected release is available for operators maintaining upstream installations. For distribution packages or embedded components, follow the relevant vendor update. Afterwards, verify that the running service uses the new version and the application still works.

If an update cannot be applied yet, HTTP/1.1-only operation is a possible interim measure. Apache's Protocols directive controls the permitted protocols:

Protocols http/1.1

Check the virtual hosts too. A virtual host's own Protocols directive replaces the base-server setting. A global change is insufficient if a virtual host still enables h2 or h2c. TLS is configured separately; HTTP/1.1 can still use HTTPS. Apache configuration reference

Coordinate the change with operations, validate the configuration and apply it using your distribution's procedure. Then use a connection test to confirm which protocol the relevant endpoint actually negotiates. Record an owner and a deadline for replacing the interim measure with the regular update.

What a completed update does not establish

Updating software and investigating a possible intrusion are separate tasks. Unexpected process launches, files or connections should also bring the server into your incident process. Those findings require investigation; individually, they establish neither this CVE as the cause nor a successful attack.

Preserve available evidence before rebuilding or log rotation removes it. Record which systems and credentials have been examined, what is established and which questions remain open. The incident report template provides a structure for that work.

For each updated system, retain the previous package version, the change applied, the functional check and any remaining exception. This makes the outcome verifiable rather than ending the record at “update assigned”.

Sources checked on 13 November 2026. The illustration explains the technical relationship schematically; it does not depict an observed attack on Kopexa.