The Apache Software Foundation released HTTP Server 2.4.71 on November 11, 2026, fixing CVE-2026-119618, a critical HTTP/2 vulnerability that could let an unauthenticated attacker execute code on an affected server. NHS England’s November 12 alert says proof-of-concept exploit code is public and assesses exploitation as likely, without identifying a confirmed attack campaign.
HTTP/2 must be enabled for exploitation
The flaw is a race condition in the assign_headers() function of Apache’s mod_http2 module. Red Hat explains that a worker thread can write into memory owned by the connection thread, corrupting the server’s internal memory and potentially enabling code execution within the httpd process.
Apache lists two affected upstream release ranges.
Apache HTTP Server versions 2.4.55 through 2.4.70.
The standalone mod_h2 module from GitHub, versions 2.0.8 through 2.0.42.
Red Hat’s bulletin lists additional conditions for exploitation: the HTTP/2 module must be loaded, the server must have h2 or h2c enabled through its Protocols configuration, and an attacker must be able to reach it with HTTP/2 requests. Servers configured to serve only HTTP/1.1 aren’t affected by this vulnerability.
Vendor backports complicate version checks
Canonical’s Ubuntu security tracker illustrates why Apache’s base version alone can give the wrong answer. Its security team notes that newer versions of the HTTP/2 module have been backported into stable Ubuntu releases, bringing newer module code into older server packages.
The tracker lists Ubuntu 22.04 LTS as fixed in 2.4.52-1ubuntu4.27 and Ubuntu 24.04 LTS as fixed in 2.4.58-1ubuntu8.19.
Those records show that a lower base version isn’t sufficient evidence of safety, while a version inside the upstream affected range isn’t sufficient evidence that a vendor-patched installation remains vulnerable. For distribution-managed installations, the vendor’s CVE status and full package revision provide a more useful assessment than the base Apache version in isolation.
Red Hat’s severity rating varies by product
Red Hat rates the vulnerability Critical overall but classifies it as Important in Red Hat Enterprise Linux 9 and 10. Its security team says those products allocate memory separately for each HTTP/2 stream, substantially increasing the complexity of exploitation.
Red Hat Enterprise Linux 8 and earlier aren’t affected, according to the company’s assessment. On RHEL 9 and 10, HTTP/2 support ships in a separate mod_http2 package, making that module’s patch status part of the assessment rather than the main httpd package alone.
HTTP/1.1 provides a temporary fallback
Apache recommends upgrading to HTTP Server 2.4.71. Distribution vendors can also supply fixes through their own package releases, as Canonical’s published revisions demonstrate.
Where immediate patching isn’t possible, Red Hat and NHS England describe a temporary mitigation that restricts Apache to HTTP/1.1 by removing h2 and h2c from the Protocols directive. Red Hat’s procedure includes restarting httpd after the configuration change. NHS England says the workaround is subject to compatibility and performance requirements.
Standalone module users face a maintenance limit
The separate icing/mod_h2 GitHub repository was archived on June 9, 2026. Its maintainer says the standalone repository is no longer maintained, although the module continues to be maintained within the Apache HTTP Server project. NHS England advises affected organizations using the archived project to migrate to the HTTP/2 implementation maintained as part of Apache HTTP Server.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
