{"id":12605,"date":"2026-11-11T13:44:06","date_gmt":"2026-11-11T19:44:06","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-162-remote-code-execution-in-apache-http-server-mod_http2\/"},"modified":"2026-11-11T13:47:48","modified_gmt":"2026-11-11T19:47:48","slug":"alert-2026-162-remote-code-execution-in-apache-http-server-mod-http2","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-162-remote-code-execution-in-apache-http-server-mod-http2\/","title":{"rendered":"Alert 2026-162 Remote code execution in Apache HTTP Server mod_http2"},"content":{"rendered":"\n

Affected product(s): <\/h2>\n\n\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td><\/tr>
Apache HTTP Server (mod_http2)<\/strong><\/td>2.4.55 through 2.4.70 (CVE-2026-119618, critical).<\/td><\/tr>
Standalone mod_h2 module (GitHub)<\/strong><\/td>2.0.8 through 2.0.42 (CVE-2026-119618). No fixed release.<\/td><\/tr>
Apache HTTP Server (mod_md)<\/strong><\/td>2.4.30 through 2.4.70 (CVE-2026-106023, important).<\/td><\/tr>
Apache HTTP Server (mod_vhost_alias)<\/strong><\/td>2.4.69 and 2.4.70 (CVE-2026-109163, low).<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The httpd fix is 2.4.71. Not every 2.4 branch is affected by the critical issue: that one starts at 2.4.55. The vendor did not publish CVSS scores.<\/p>\n\n\n\n

Description<\/h2>\n\n\n\n

Apache HTTP Server 2.4.71 has been published, released on Nov 11, 2026. It fixes three vulnerabilities: one critical, one important and one low, according to the vendor. The vendor did not publish CVSS scores; the severities given here are the vendor’s, in words.<\/p>\n\n\n\n

CVE<\/strong><\/td>Severity<\/strong><\/td>Module<\/strong><\/td>Affected range<\/strong><\/td><\/tr>
CVE-2026-119618<\/strong><\/td>Critical<\/td>mod_http2 \/ mod_h2<\/td>httpd 2.4.55 through 2.4.70; mod_h2 2.0.8 through 2.0.42<\/td><\/tr>
CVE-2026-106023<\/strong><\/td>Important<\/td>mod_md<\/td>httpd 2.4.30 through 2.4.70<\/td><\/tr>
CVE-2026-109163<\/strong><\/td>Low<\/td>mod_vhost_alias<\/td>httpd 2.4.69 and 2.4.70<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The most serious is CVE-2026-119618, rated critical: a synchronization flaw in the assign_headers() function of mod_http2 can corrupt heap memory and allow remote code execution. It affects Apache HTTP Server 2.4.55 through 2.4.70, including 2.4.70 released on Nov 6, 2026, and the standalone mod_h2 module 2.0.8 through 2.0.42. The vendor does not describe an authentication requirement. A packager states that an unauthenticated remote attacker who can reach the server may be able to execute code if HTTP\/2 (h2 or h2c) is enabled, and that servers that only serve HTTP\/1.1 would not be affected. That same packager published a CVSS 3.1 score of 9.8 for this issue; it is not a score from Apache or from NVD, which had no metrics at the time of this review. On some of its branches (RHEL 9 and 10) it rates the impact as important, not critical, because of an implementation difference, and it treats releases earlier than RHEL 9 as not affected.<\/p>\n\n\n\n

For the standalone module, the vendor did not publish a fixed version. The upstream repository has been archived and unmaintained since Jun 9, 2026, and the latest release remains 2.0.42, which is inside the affected range. Anyone still using it should move to the mod_http2 module included in httpd 2.4.71, or to their distribution’s patched package.<\/p>\n\n\n\n

In the same batch, CVE-2026-106023, rated important, is a NULL pointer dereference in mod_md during HTTP request processing, which can crash child processes. It affects 2.4.30 through 2.4.70. CVE-2026-109163, rated low, is a one-byte stack overwrite in mod_vhost_alias, a leftover from CVE-2026-63292 (fixed in 2.4.69), and only affects 2.4.69 and 2.4.70.<\/p>\n\n\n\n

The vendor reports no active exploitation of these vulnerabilities. No verified public proof of concept was identified. A packager states that public research demonstrated a reliable exploit against a default-configured server with mod_http2 enabled. That speaks to exploitability, not to a confirmed compromise in the wild.<\/p>\n\n\n\n

As for distribution packages, Debian unstable already has apache2 2.4.71-1 on most architectures; bookworm, trixie and forky, at this time, still lack that version. RHEL 9 and 10 have advisories from today that fix the critical issue in the mod_http2 package, not by rebasing httpd to 2.4.71; RHEL 8 and earlier, according to that packager, are not affected by CVE-2026-119618. Red Hat JBoss Core Services and the hardened images are listed as affected, still without an advisory. At this time no public advisory was found for Ubuntu or for SUSE or openSUSE, and no AlmaLinux or Rocky Linux errata was confirmed. No advisories from other vendors were found for products with embedded Apache.<\/p>\n\n\n\n

Mitigation<\/h2>\n\n\n\n

Inventory Apache HTTP Server installations, record the exact version and whether they have HTTP\/2 (h2 or h2c) or the standalone mod_h2 module, and prioritize updating to 2.4.71 or to the distribution’s patched package when one exists.<\/p>\n\n\n\n

The vendor did not publish an official workaround. As temporary containment, until the patch can be applied, h2 and h2c can be removed from the Protocols directive, or mod_http2 can be disabled, so that the server remains on HTTP\/1.1 only. That measure is based on the critical flaw living in that module and on a packager limiting exposure to HTTP\/2 being enabled. It does not replace the update. The impact on clients that depend on HTTP\/2 should be assessed.<\/p>\n\n\n\n

Anyone loading mod_h2 from the GitHub repository does not, at this time, have a new standalone release to apply: it must be replaced with the module from 2.4.71. Disabling mod_md would, at most, be a partial containment of CVE-2026-106023, not of the critical issue, and it is not a vendor recommendation.<\/p>\n\n\n\n

These measures do not replace the update. The patch does not undo a prior compromise.<\/p>\n\n\n\n

Detection<\/h2>\n\n\n\n

The vendor did not publish indicators of compromise. Detection is limited to inventorying the running version and checking whether HTTP\/2 (h2 or h2c) is enabled and whether the standalone mod_h2 module is loaded.<\/p>\n\n\n\n

Solution<\/h2>\n\n\n\n

The solution is to update Apache HTTP Server to version 2.4.71 or later, or to install the distribution’s patched package when one is available. On installations that still use the standalone mod_h2 module (2.0.8 through 2.0.42), replace it with the mod_http2 module from 2.4.71. Back up the configuration before updating.<\/p>\n\n\n\n

Product \/ branch<\/strong><\/td>Fix<\/strong><\/td><\/tr>
Apache HTTP Server 2.4.x<\/strong><\/td>2.4.71 or later<\/td><\/tr>
Standalone mod_h2 (2.0.8 through 2.0.42)<\/strong><\/td>No fixed release; move to the mod_http2 module in 2.4.71<\/td><\/tr>
Debian unstable<\/strong><\/td>apache2 2.4.71-1 (already on most architectures). bookworm, trixie and forky, at this time, not yet<\/td><\/tr>
RHEL 10, 10.0 EUS and 10.2 EUS<\/strong><\/td>mod_http2 package from RHSA-2026:98978, 98953 and 98979<\/td><\/tr>
RHEL 9, 9.4 E4S, 9.6 EUS and 9.8 EUS<\/strong><\/td>mod_http2 package from RHSA-2026:98981, 98968, 98954 and 98982<\/td><\/tr>
RHEL 8 and earlier<\/strong><\/td>Not affected by CVE-2026-119618, according to the packager<\/td><\/tr>
Ubuntu, SUSE \/ openSUSE, AlmaLinux, Rocky Linux<\/strong><\/td>At this time no public advisory was found, or it is unconfirmed<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The RHEL 9 and 10 advisories cover CVE-2026-119618 in the mod_http2 package; they are not equivalent to an httpd rebase to 2.4.71, which also fixes CVE-2026-106023 and CVE-2026-109163.<\/p>\n\n\n\n

For information on how to update, visit the following link:<\/p>\n\n\n\n

https:\/\/httpd.apache.org\/security\/vulnerabilities_24.html<\/a><\/p>\n\n\n\n

Additional information: <\/h2>\n\n\n\n