Apache HTTP Server HTTP/2 bug can let attackers run code remotely
Nov 12, 2026 · Summarized by Fundy Tech from The Hacker News
Apache fixed a critical HTTP/2 flaw in version 2.4.71. Servers with HTTP/2 enabled should update or turn off h2 and h2c until they can.
Key points
- CVE-2026-119618 affects Apache 2.4.55 through 2.4.70.
- Only servers with HTTP/2 enabled are affected.
- Red Hat and Apache both released guidance and fixes.
Why it matters
If your website or app runs on Apache, this could be a direct server takeover risk. The flaw can be used without authentication on exposed servers. Small businesses should check whether HTTP/2 is enabled and apply the fixed release. If patching is delayed, removing h2 and h2c from the Protocols directive reduces exposure.
Who’s affected: Apache HTTP Server installations with HTTP/2 enabled
What to do
- Update Apache HTTP Server to 2.4.71.
- Remove h2 and h2c if you cannot patch yet.
- Check every server and virtual host for HTTP/2.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.