Apache Patches Critical HTTP/2 Flaw as Security Alerts Urge Updates

Apache has released a fix for a critical web-server vulnerability that could allow remote code execution. Security advisories urge prompt updates while stressing that actual exposure depends on configuration and the installed software package.

Rows of server cabinets in a data centre. — Server cabinets in a data centre. Illustrative photograph for reporting on web-server security. Photograph: imgix / Unsplash.

Apache has released HTTP Server 2.4.71 to address a critical vulnerability in its HTTP/2 implementation, prompting security alerts on 12 November. The flaw, tracked as CVE-2026-119618, can lead to remote code execution. The Apache advisory dates the corrected upstream release to 11 November.

Apache lists upstream HTTP Server versions 2.4.55 through 2.4.70 as affected. Separately distributed versions 2.0.8 through 2.0.42 of the mod_h2 project are also included. These version ranges identify affected upstream code; organisations using operating-system packages also need to check their distributor’s own security update information.

Public demonstration adds urgency

NHS England’s alert says researchers have published a proof-of-concept exploit and assesses exploitation as likely. That assessment increases the urgency of remediation. The cited advisories describe a public demonstration and a risk of attack, without establishing that the vulnerability has already been exploited in live attacks.

The Computer Incident Response Center Luxembourg, or CIRCL, explains that a concurrency problem can corrupt the server’s memory while it handles simultaneous HTTP/2 activity. Successful exploitation could run code with the privileges of the Apache process. The consequences therefore depend partly on the permissions and environment of that process.

Configuration determines exposure

CIRCL says the vulnerable path requires HTTP/2 to be enabled and reachable on an affected Apache service. Finding the module installed or loaded is insufficient to establish exposure. Its guidance prioritises internet-facing servers that accept HTTP/2 and recommends checking the effective configuration, including settings for individual virtual hosts.

An intermediary can also change the picture. A content delivery network, load balancer or reverse proxy may accept HTTP/2 from visitors while communicating with Apache over HTTP/1.1. CIRCL advises checking the actual connection to the backend. A public website advertising HTTP/2 does not, on its own, demonstrate that this Apache flaw is reachable.

A fixed package may retain an older version number

Ubuntu’s security notice, published on 12 November, provides an example of the distributor update route. For Ubuntu 24.04 LTS, it lists apache2 version 2.4.58-1ubuntu8.19 among the corrected packages. That number retains an older upstream base while incorporating the security changes supplied for the supported operating system.

Red Hat explains that it commonly backports fixes into existing package versions to preserve stability and compatibility. As a result, scanners that consider only the apparent upstream version can flag a package that has been corrected. Remediation checks need to match the deployed package against its vendor’s advisory.

Red Hat also describes differences between builds. It rates its RHEL 9 and RHEL 10 packages Important because their memory-allocation design makes exploitation more difficult, while reporting RHEL 8 and earlier as unaffected. The general critical classification therefore needs to be read alongside the assessment for the specific product in use.

Supported updates remain the lasting response

NHS England recommends updating affected installations to a fixed, supported release. Where immediate patching is not possible, its temporary mitigation is to restrict the service to HTTP/1.1, subject to compatibility and performance requirements. Organisations should assess the effect on their own applications before making that operational change.

The alert also highlights a maintenance issue for users of the standalone icing/mod_h2 project: its repository was archived in June 2026 and will receive no further security updates. NHS England advises those organisations to migrate to the HTTP/2 implementation maintained within Apache HTTP Server, bringing the component back onto a supported update path.

Apache credits Anthropic’s OSS Scanner and Google Cloud Vulnerability Research’s Anthony Weems and Simon Scannell with identifying the flaw. Its disclosure timeline records reports from Anthropic on 26 October and Google on 3 November, followed by the patched release on 11 November. The advisory remains the upstream reference for affected versions.