Apache HTTP/2 RCE CVE-2026-119618: check your server

Originally published on proxymint.

Apache HTTP/2 vulnerability CVE-2026-119618 is a critical RCE in mod_http2, fixed in 2.4.71. A one-minute check for version, module and h2/h2c.

TL;DR

• Run curl -sI --http2 https://your-host/ -o /dev/null -w '%{http_version}\\n' before anything else. If it prints 2, your Apache negotiates HTTP/2 and CVE-2026-119618 applies to it, so it needs 2.4.71 or the fixed distro package today.
• The affected range is wide. It covers Apache 2.4.55 through 2.4.70 and the standalone mod_h2 2.0.8 through 2.0.42. Apache rates the bug critical, a race in mod_http2's assign_headers() that can lead to remote code execution.
• Check your distro package, not just the upstream number. Debian trixie is fixed in 2.4.71-1~deb13u1, bookworm was still listed as vulnerable on 12 November, and Red Hat says RHEL 8 and earlier aren't affected.
• The stopgap before a patch is Protocols http/1.1 in the main config and in every vhost that sets its own line. Then configtest, graceful, and run the curl check again until it prints 1.1.

Key takeaways

• HTTP/2 being on is what makes you exposed. A server limited to HTTP/1.1 isn't reachable through this bug, and Apache's own default is http/1.1 only.
• On Debian, a2enmod http2 quietly turns on h2c too. The packaged http2.conf sets Protocols h2 h2c http/1.1, so plain HTTP on port 80 can speak HTTP/2 as well.
• A CDN in front isn't a fix. Cloudflare talks HTTP/2 to the origin by default, and a reachable origin IP skips the front entirely.
• 2.4.71 also fixes two other bugs, in mod_md and mod_vhost_alias, so take it even where HTTP/2 is off.

Read the full guide on proxymint, with the commands, tables and sources.