Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

The vulnerability, rated 9.8 out of 10 on the CVSS scale, was fixed in version 2.4.71 released yesterday. Only servers with HTTP/2 enabled through the Protocols directive are affected, and attackers need no authentication to exploit the flaw. Red Hat, which ships the server as part of Red Hat Enterprise Linux, confirmed that public research has demonstrated a reliable exploit against a server in its default configuration with mod_http2 enabled.

Affected Versions

The flaw affects Apache HTTP Server versions 2.4.55 through 2.4.70. Standalone builds of the module, released on GitHub as mod_h2, are affected from version 2.0.8 through 2.0.42. Servers updated to version 2.4.67 or later (up to 2.4.70) still remain vulnerable to this new flaw, as it was introduced after the previous HTTP/2 vulnerability (CVE-2026-23918) was fixed.

Distribution-Specific Fixes

Red Hat shipped fixes for Red Hat Enterprise Linux 9 and 10 yesterday, rating the flaw Important rather than Critical on those releases. Their mod_http2 packages contain additional protections that make an attack much harder. On Red Hat Enterprise Linux 9, the fix ships as mod_http2-2.0.26-7.el9_9.1. Debian and Amazon Linux have also released fixes, though Ubuntu's CVE tracker had no page for the flaw when checked.

Workarounds and Next Steps

The Apache HTTP Server advisory offers no workaround, but Wiz advises administrators who cannot update yet to remove h2 and h2c from the Protocols directive, leaving only http/1.1. The standalone mod_h2 project has not published a fixed release yet, as its repository has been archived since June 9. The flaw was reported on October 26 by Anthropic's OSS Scanner and later confirmed by researchers at Google Cloud Vulnerability Research.