The Apache HTTP Server project released version 2.4.71 on November 11, with a fix for CVE-2026-119618, a flaw in the HTTP/2 module that the project rates critical. A thread-safety bug in mod_http2 can corrupt memory and lead to remote code execution in httpd 2.4.55 through 2.4.70. Red Hat gives the flaw a CVSS score of 9.8, and according to the company, public research has demonstrated a reliable exploit against a default-configured server with mod_http2 enabled.

According to Red Hat, only servers with HTTP/2 enabled in Apache’s Protocols directive are affected. On hosting servers, that depends on how the control panel sets up Apache. With cPanel’s default Apache profile the module cannot be installed, Plesk ties its HTTP/2 support to nginx, and DirectAdmin keeps HTTP/2 always on for its main web server.

Key facts

  • Not affected: servers that serve only HTTP/1.1, and Red Hat’s own packages for RHEL 8 and earlier, according to Red Hat.
  • Also fixed: CVE-2026-106023, an important-rated mod_md flaw that crashes child processes, and CVE-2026-109163, a low-rated mod_vhost_alias overflow.
  • Distributions: Red Hat shipped fixed mod_http2 packages for RHEL 9 and 10 on November 11. Debian lists its stable releases as vulnerable.
  • cPanel: EasyApache 4 25.95 moved to 2.4.70 on November 11. For cPanel servers on CloudLinux, fixed 2.4.71 builds reached CloudLinux’s stable repositories on November 12.

A Thread-Safety Bug in the HTTP/2 Module

The Apache advisory describes the flaw as “Concurrent Execution using Shared Resource with Improper Synchronization” in the module’s assign_headers() function. Red Hat’s analysis is more specific: a worker thread modifies memory owned by the connection thread through a shared, lock-free allocator. According to Red Hat, the issue affects servers with HTTP/2 enabled through the Protocols directive, in its encrypted (h2) or cleartext (h2c) form. Anthropic’s OSS Scanner reported the flaw to the Apache security team on October 26, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported it on November 3.

The module is also distributed separately on GitHub as mod_h2, and the advisory lists mod_h2 2.0.8 through 2.0.42 as affected. The latest release on the project’s GitHub page, as of November 12, is 2.0.42 from May 29. CVE-2026-119618 is the fifth mod_http2 flaw fixed in httpd releases this year and the only flaw in those releases that the project has rated critical.

CloudLinux Rolls Out Kernel Fixes for a Local UDP Flaw Used to Crash a Server 12 Times

Default cPanel Leaves mod_http2 Out. DirectAdmin Keeps HTTP/2 On.

cPanel builds its own Apache packages for EasyApache 4. In those packages, the HTTP/2 module cannot be installed alongside the prefork or ITK process models, and cPanel’s default profile uses prefork. None of the profiles cPanel publishes in its EasyApache profile repository includes mod_http2. A cPanel server is therefore exposed only if its administrator switched to the event or worker model and installed the module. CloudLinux’s status page for the flaw gives the same test: if the ea-apache24-mod_http2 package is not installed, Apache does not serve HTTP/2 and the server is not exposed.

EasyApache 4 25.95, released on November 11, updated Apache to 2.4.70, the last version the advisory lists as affected. Early on November 12, cPanel’s public repository for the Apache package merged the update to 2.4.71, with a change log entry that names CVE-2026-119618 and CVE-2026-109163. A merge is not yet a release, and cPanel’s release notes, last modified on November 11, do not list the build.

For cPanel servers on CloudLinux, the fixed packages are already out. CloudLinux’s status page announced on November 12 at 09:23 UTC that EasyApache 4 builds of ea-apache24 and ea-apache24-mod_http2 at version 2.4.71-1~urgent are in its stable repositories. Until then, CloudLinux had advised removing the HTTP/2 module, after which clients connect over HTTP/1.1.

Plesk’s documentation ties its HTTP/2 support to nginx. HTTP/2 is enabled in Plesk by default, and the troubleshooting steps for a site that falls back to HTTP/1.1 include checking that nginx is enabled.

DirectAdmin removed the option to switch HTTP/2 off in version 1.658, released in January 2024. Its change log reads: “HTTP/2 support will always be enabled” for the main web server. For Apache-based setups, exposure depends on whether Apache itself handles HTTP/2 through mod_http2, rather than leaving it to another front-end server.

Red Hat and Debian

Red Hat released fixed mod_http2 packages for Red Hat Enterprise Linux 9 and 10 on November 11, including RHSA-2026:98981 for RHEL 9 and RHSA-2026:98978 for RHEL 10. It rates the flaw Important rather than Critical on those releases. Their mod_http2 packages allocate each HTTP/2 stream from a separate allocator, which according to Red Hat substantially increases the complexity of an exploit. Red Hat lists its packages for RHEL 8 and earlier as not affected and notes that versions of mod_http2 before 2.0.8 do not contain the affected code.

Debian’s security tracker lists the apache2 packages in bookworm, trixie and forky as vulnerable. Only unstable has the fixed version, 2.4.71-1.