Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

Apache HTTP/2 Vulnerability CVE-2026-119618: Check Your Server

Apache HTTP/2 Vulnerability CVE-2026-119618: Check Your Server

The Apache HTTP/2 vulnerability, CVE-2026-119618, is a critical flaw in the web server’s HTTP/2 module that could let someone with no login run code on your server. The fix came out on 11 November, and the vendors disagree on whether a working exploit exists. If you run Apache yourself, or pay a host who does, you can check your exposure quickly.

What the Apache HTTP/2 vulnerability actually is

On 11 November the Apache HTTP Server Project released version 2.4.71. Its advisory rates CVE-2026-119618 critical. The flaw sits in mod_http2 (what mod_http2 and HTTP/2 are) and affects versions 2.4.55 through 2.4.70. Red Hat scores it 9.8 out of 10 and says only servers with HTTP/2 enabled are affected. Servers set to HTTP/1.1 only are not.

The sources disagree on exploits. Red Hat says public research has demonstrated a reliable exploit against a default-configured server. The Hacker News notes Red Hat does not name that research. Wiz says no exploit was available and none had been seen in the wild when it published. I could not settle this from the pages I opened, so take the cautious reading and patch or mitigate now.

Why it matters if you run a small or mid-sized business

Most businesses do not think of their web server as a door. It is. Port 443 is open to the whole internet by design, and nobody has to phish anyone to reach it. Red Hat says an attacker needs no authentication and could take full control of the server process. From there, the usual next step is whatever that process can read: configuration files, database passwords, other sites on the same machine.

The lesson is about knowing what you run. This is a flaw in one module, and it only bites when HTTP/2 is switched on. That setting can be server-wide or per virtual host, so a tidy global config can hide an exposed site. Version numbers also mislead. Linux distributions ship their own builds with their own package numbers, so a distribution can fix a flaw without moving to 2.4.71, and the version number alone may not tell you whether you are safe.

Patch status is uneven too. When The Hacker News checked, Debian bookworm, trixie and forky were listed as vulnerable with no fix, Amazon Linux was pending, and Ubuntu had no status page. One secondary write-up says Debian shipped fixed packages on 12 November. Confirm against your own distribution before you rely on any of this. Wiz says 64% of the cloud environments in its data have resources running affected versions, and notes that this figure ignores configuration.

A penetration tester starts with exactly these questions: what is listening, what version does it admit to, and what can I reach from outside?

What to do this week

  1. Ask your IT person or host whether you run Apache, and on which servers, including any behind a reverse proxy or control panel.
  2. Have them check the package version with your distribution’s package manager, not only apache2 -v or httpd -v, and compare it with your vendor’s security notice for CVE-2026-119618.
  3. Have them check whether HTTP/2 is on: look for the http2 module in apache2ctl -M or httpd -M, search the config for Protocols lines offering h2 or h2c, and test each site with curl --http2.
  4. If you cannot patch yet, ask them to remove h2 and h2c from the Protocols directive so it reads Protocols http/1.1, as Wiz advises, in the server config and every virtual host. Apache’s own advisory offers no workaround.
  5. If the server was exposed and unpatched, ask whether the passwords and keys it can read need rotating, and set up a routine for the next one with our patch management guide.

Frequently asked questions

Is my server affected by CVE-2026-119618? It is if it runs Apache HTTP Server 2.4.55 to 2.4.70 with HTTP/2 switched on. Servers set to HTTP/1.1 only are not affected, according to Red Hat. Check your distribution’s package notice, because version numbers can mislead.

Is there a workaround if I cannot patch yet? Apache’s advisory offers none. Wiz advises removing h2 and h2c from the Protocols directive so it reads Protocols http/1.1, in the server config and every virtual host.

Is the flaw being exploited? The sources disagree. Red Hat says public research has demonstrated a reliable exploit. Wiz said no exploit was available and none had been seen in the wild when it published. Treat it as urgent.

How Wolfcore helps

Checking one server is easy. Knowing every server, subdomain and forgotten test site that answers the internet is harder, and it is what attackers do first. A manual penetration test looks at your public systems the way an attacker would. Our external vulnerability assessment case study shows what that looks like in practice. To start smaller, run the free web vulnerability scan, or book a conversation about testing.

Ruben Selby, founder and penetration tester at Wolfcore

Related reading: N-able N-central zero days: questions for your IT provider

Sources