Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

HTTP/2 and Apache mod_http2: what they are and the CVE-2026-119618 flaw

Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 13 November 2026.

In one sentence: HTTP/2 is the faster, newer way browsers talk to web servers, and a critical bug in the Apache web server’s HTTP/2 module means any server running an affected version with HTTP/2 switched on needs updating now.

What it is

Apache HTTP Server is one of the most common web servers. HTTP/2 is a newer version of the web protocol that lets a browser fetch many things over one connection. In Apache it is provided by a module called mod_http2.

The Hacker News reported on 12 November 2026 that a critical flaw in mod_http2 can let a remote attacker run code on the server. It is tracked as CVE-2026-119618. It affects Apache versions 2.4.55 through 2.4.70 and is fixed in 2.4.71, released on 11 November.

What is and is not known

Plain facts from The Hacker News report, which quotes the vendors:

  • Only servers with HTTP/2 enabled are affected, according to Red Hat.
  • An attacker who can reach the server needs no login. Red Hat rates the flaw 9.8 out of 10 on the CVSS scale (see CVSS).
  • Red Hat says public research has demonstrated a reliable exploit against a default configuration, but does not name the research. Wiz said that day that no exploit was available and no exploitation in the wild had been reported. These two statements conflict, so treat the risk as real and do not assume it is safe.
  • Red Hat rates it Important rather than Critical on Red Hat Enterprise Linux 9 and 10, because its packages give each HTTP/2 stream its own memory allocator, which makes an attack much harder. Red Hat Enterprise Linux 8 and earlier do not contain the vulnerable code.
  • The Apache advisory offers no workaround. Wiz advises that admins who cannot update yet remove h2 and h2c from the Protocols directive, leaving Protocols http/1.1.

How HTTP/2 gets switched on

The module documentation, linked from the report, says HTTP/2 runs only where the Protocols directive turns it on. The value h2 means HTTP/2 over TLS and h2c means HTTP/2 over plain TCP. The directive can be set for the whole server or for one virtual host, so you must check the server-wide setting and every virtual host.

Linux distributions ship their own builds. At the time of the report, Debian bookworm, trixie and forky were listed as vulnerable with no fixed package, Amazon Linux was pending, and Ubuntu had no status page. So “I run apt upgrade” is not proof you are safe. Check your distribution’s tracker for CVE-2026-119618.

Who it affects and how badly

Any organisation in the UK, EU, US or Armenia that runs its own Apache web servers, reverse proxies or application gateways. That includes agencies hosting client sites, SaaS start-ups, MSPs hosting for customers and councils with older web estates. A small business whose site sits on managed WordPress hosting should ask the host whether it is patched.

Realistic worst cases if a server were taken over: for a small business, a defaced or offline website and a rebuild. For a mid-sized one, a foothold on the network that holds customer data. For a regulated business, a personal data breach with reporting duties. This is a possibility, not something the sources say has happened.

The UK angle

Cyber Essentials requirements v3.3 (NCSC, April 2026) say software must be updated within 14 days of release where the update addresses vulnerabilities with a CVSS v3 base score of 7 or above, or the vendor calls them critical or high risk. Fixed Apache 2.4.71 was released on 11 November 2026, so counting 14 days gives 25 November 2026 for a firm that is certified or applying. Where your distribution has no fixed package yet, document what you have done instead, such as the Protocols change, and keep checking.

What we check on a test

Method only, no findings claimed:

  • Which public web servers run Apache, and which version and packaging they report.
  • Whether HTTP/2 is negotiated, by checking the protocol the server offers, on every hostname and virtual host in scope.
  • Whether the Protocols setting differs between virtual hosts.
  • Whether a reverse proxy or content delivery network sits in front, and what it terminates.
  • Whether the distribution has published a fix for the package in use.

We do not run exploit code against a live system as a way of confirming this. Version and configuration evidence is enough to prioritise.

Apache 2.4.55to 2.4.70? h2 or h2c inProtocols? Update to2.4.71 or fix Record thedecision If no fix yet: remove h2 and h2c, keep http/1.1 If either answer is no, you are not in the affected group

How to check whether yours is affected

  1. List every Apache server, including reverse proxies and appliances that embed it.
  2. Find the Apache version or the distribution package version.
  3. Search the configuration for Protocols, h2 and h2c, in the server-wide setting and in every virtual host.
  4. Look up CVE-2026-119618 in your distribution’s security tracker.
  5. Use the free scan at https://wolfcore.co.uk/free-web-vulnerability-scan/ for what your public site shows. It does not replace checking the server.

How to fix or prevent it

For a plain-English walk through of what to ask your IT provider this week, read our post Apache HTTP/2 vulnerability CVE-2026-119618: check your server. This entry covers the HTTP/2 and mod_http2 background.

  1. Update to Apache 2.4.71, or to your distribution’s fixed package where one exists.
  2. If you cannot update, remove h2 and h2c from Protocols so the server uses HTTP/1.1 only, then restart and test the site.
  3. If you use the standalone mod_h2 build, note that the report said no fixed release had been published and the repository was archived, so apply the Protocols change.
  4. Keep an inventory of public web servers so the next advisory takes minutes to answer.
  5. Turn on automatic updates where your platform allows it.

Frequently asked questions

Which versions are affected? Apache 2.4.55 through 2.4.70, with HTTP/2 enabled.

Is there a workaround? Wiz advises removing h2 and h2c from Protocols. The Apache advisory lists no workaround.

Is it being exploited? Wiz said no exploitation in the wild had been reported when it published. Red Hat says public research shows a reliable exploit.

Related terms

Category hub: Ports, protocols and services. Related entries: cve, cvss, cisa-kev, patch-management, zero-day, port-135-msrpc.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. See manual penetration testing and start with the free web vulnerability scan.