Critical Apache HTTP/2 Remote Code Execution Flaw: What to Check and How to Fix It

A critical vulnerability has been identified in Apache HTTP Server's HTTP/2 module, mod_http2, tracked as CVE-2026-119618. As reported by The Hacker News on 12 November 2026, the flaw affects Apache HTTP Server versions 2.4.55 through 2.4.70 and allows an unauthenticated remote attacker to execute arbitrary code on the affected server. A patched version, 2.4.71, was released on 11 November 2026. According to Red Hat, which distributes Apache HTTP Server as part of Red Hat Enterprise Linux, only servers with HTTP/2 enabled are affected by this vulnerability.

Why this matters for UK organisations

Apache HTTP Server is one of the most widely deployed web server platforms in the world, used across a broad range of UK organisations to serve public-facing websites, internal web applications, APIs and development environments. A remote code execution vulnerability that requires no authentication sits at the most serious end of the vulnerability severity scale: it means that any attacker who can reach the server over a network connection can potentially take full control of it without needing any credentials or prior access. HTTP/2 has become increasingly common in recent years as organisations have adopted it for its performance benefits, which means the pool of potentially affected servers is significant.

The risk is compounded by the fact that Apache instances are often present in environments where they may not be immediately obvious — containerised workloads, development and staging servers, third-party managed hosting, and legacy applications that have not been reviewed recently. Organisations that have a clear inventory of their web server infrastructure are well placed to respond quickly; those without that visibility face a more complex discovery task before they can confirm whether they are affected.

What to review

The immediate priority is to identify all instances of Apache HTTP Server running in your environment, including those in containerised deployments, development infrastructure and any third-party or managed hosting arrangements. For each instance, confirm the version in use and whether HTTP/2 is enabled — if both conditions apply, upgrading to version 2.4.71 should be treated as a priority task. This vulnerability is also a useful prompt to review whether your asset inventory accurately reflects all web server infrastructure, including instances that may have been deployed outside of a formal change management process.

Source: The Hacker News