Critical Apache HTTP/2 flaw (CVE-2026-119618): who needs to update now

In short: Apache's HTTP/2 module has a critical vulnerability (CVE-2026-119618). An unauthenticated attacker can use it to run code on the server with the privileges of the web server process. Versions 2.4.55 to 2.4.70 are affected, but only when HTTP/2 is enabled. A fix is already out. If you run Apache on a V-Server or root server, check it today.

What happened

The Apache Software Foundation has fixed a bug in mod_http2. According to BleepingComputer it is a race condition: when several threads access the same data at once, an attacker can corrupt heap memory and turn that into code execution. The flaw was found by Anthropic's OSS Scanner and Google Cloud's Vulnerability Research team.

Golem reports that Red Hat rates it 9.8 out of 10. BleepingComputer says there is no official score yet; security firm Wiz rates it critical. According to Wiz, no public exploits or attacks are known so far – heise calls an exploit possible but difficult. That can change quickly.

The standalone mod_h2 module, versions 2.0.8 to 2.0.42, is affected too. The same release fixes two less severe bugs: CVE-2026-106023 in mod_md and CVE-2026-109163 in mod_vhost_alias.

Who is actually affected

• Apache with HTTP/2 enabled: yes – act now. HTTP/2 is off by default in Apache, but many people turn it on for faster sites.
• Apache without HTTP/2: not exposed through this flaw. Install the update anyway; it fixes the other two bugs as well.
• nginx only: not affected – this is an Apache-only bug.
• Apache behind nginx (reverse proxy): usually nginx speaks HTTP/2 to browsers and only HTTP/1.1 to Apache. Still check whether HTTP/2 is enabled in Apache itself.

What you should do now

1. Check the version: apache2 -v (Debian/Ubuntu) or httpd -v (AlmaLinux, Rocky). If it is between 2.4.55 and 2.4.70, read on.
2. Is HTTP/2 on? apache2ctl -M | grep http2 or httpd -M | grep http2. If http2_module shows up, the module is loaded.
3. Update: apt update && apt upgrade or dnf upgrade httpd, then restart Apache. Distributions often backport security fixes into their own package version, so the version number may not change. Your distribution's security notice is what counts.
4. No update available yet? Turn HTTP/2 off for now: a2dismod http2 && systemctl restart apache2 (Debian/Ubuntu), or remove h2 from the Protocols line. The researchers at watchTowr recommend exactly that: patch, or drop HTTP/2 until you can.
5. Plesk on your own server: install system and Plesk updates; Plesk ships Apache through the package sources.

What we at NexoraHost say

Our own platform runs on nginx and is not affected by this flaw. On our webspace (Plesk), Apache runs behind nginx; we take care of updates on those servers – webspace customers don't need to do anything.

On your V-Servers and root servers you are the admin. We don't install updates there without asking, because that could interrupt your services. If something breaks after the update, or you're not sure whether your server is affected: open a ticket.

V-Server → · Linux root servers · Webspace · Apache vs. nginx · Source: BleepingComputer