Ethical Hacking News
Apache HTTP/2 module vulnerability exposes servers to remote code execution. The vulnerability, tracked as CVE-2026-119618, affects versions 2.4.55 through 2.4.70 of the module and has been rated as critical by the vendor, Red Hat. A fixed version of the module, version 2.4.71, has been released, and admins are urged to patch their servers immediately to prevent exploitation.
The Apache HTTP/2 module has a critical vulnerability (CVE-2026-119618) that allows an unauthenticated attacker to execute code remotely on servers. The vulnerability affects versions 2.4.55 through 2.4.70 of the module and has been rated as critical by Red Hat. The vulnerability can be exploited by creating a malicious HTTP/2 stream, allowing an attacker to execute arbitrary code on the server. Red Hat has released a fixed version of the module (2.4.71), which is available for download to prevent exploitation. Admins are advised to take immediate action to patch their servers and ensure they are running the latest version of the module.
A recent vulnerability in the Apache HTTP/2 module has been identified as a potential threat to the security of servers running the module. The vulnerability, tracked as CVE-2026-119618, affects versions 2.4.55 through 2.4.70 of the module and has been rated as critical by the vendor, Red Hat. The vulnerability allows an unauthenticated attacker to execute code remotely on the server, posing a significant risk to the security of servers that are not properly configured or updated.
The vulnerability was reported by Anthropic's OSS Scanner, a free scanning service for open-source projects that uses AI models, on October 26. The vulnerability was further analyzed by Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research, who reported it last week. The vulnerability affects only servers that have the HTTP/2 module enabled, which is the default configuration for many web servers.
The vulnerability is caused by a flaw in the way the module handles HTTP/2 streams. An attacker can exploit this flaw to create a malicious HTTP/2 stream that is executed on the server, allowing them to execute arbitrary code on the server. This can lead to a range of security issues, including the ability to steal sensitive data, disrupt service, or even take control of the server.
Red Hat has released a fixed version of the module, version 2.4.71, which is available for download. This version fixes the vulnerability and prevents an attacker from exploiting it. However, the vendor has noted that the vulnerability is rated 9.8 out of 10 on the CVSS scale, indicating that it is a highly critical vulnerability that requires immediate attention.
The vulnerability is not limited to just Apache HTTP/2 module, standalone builds of the module, released on GitHub as mod_h2, are also affected from version 2.0.8 through 2.0.42. Admins who run the Apache HTTP Server project's own releases should move to version 2.4.71, the fixed release named in its security advisory.
In addition to the vulnerability, the Apache HTTP/2 module also has a feature that allows admins to specify whether HTTP/2 is enabled or not. This feature, known as the Protocols directive, uses the h2 for HTTP/2 over TLS and h2c for HTTP/2 over plain TCP. Admins can set this directive to enable or disable HTTP/2 on a server-wide basis or for individual virtual hosts.
The vulnerability has already been exploited in a server in the default configuration with mod_http2 enabled, according to public research. The vendor has noted that security company Wiz has confirmed that no exploit is available yet and that no exploitation in the wild has been reported. However, the vendor has also noted that the vulnerability is highly critical and that admins should take immediate action to patch their servers.
In conclusion, the recent vulnerability in the Apache HTTP/2 module highlights the importance of keeping software up to date and configuring servers properly. The vulnerability allows an unauthenticated attacker to execute code remotely on the server, posing a significant risk to the security of servers that are not properly configured or updated. Admins should take immediate action to patch their servers and ensure that they are running the latest version of the module.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Critical-Flaw-in-Apache-HTTP2-Module-Exposes-Servers-to-Remote-Code-Execution-ehn.shtml
https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html
https://nvd.nist.gov/vuln/detail/CVE-2026-119618
https://www.cvedetails.com/cve/CVE-2026-119618/
Published: Thu Nov 12 00:13:49 2026 by llama3.2 3B Q4_K_M
