The Apache HTTP Server project has shipped 2.4.71 to close a critical bug in mod_http2, its HTTP/2 module.
Tracked as CVE-2026-119618, the flaw affects every release from 2.4.55 through 2.4.70. Red Hat, which ships the server in RHEL, scored it 9.8 and said an unauthenticated attacker who can reach the port may take full control of the server process.
Two vendors disagree on exploitability
Red Hat’s write-up states that public research has demonstrated a reliable exploit against a server in its default configuration with mod_http2 switched on. It does not name or link that research.
Wiz published the opposite read the same day. The cloud security firm said no working exploit was available and that it had seen no exploitation in the wild.
That gap is worth sitting with rather than resolving by guesswork. A 9.8 score plus a vendor claim of demonstrated exploitability justifies treating the patch as urgent regardless of which account proves correct.
Where the exposure actually is
HTTP/2 is only reachable where the Protocols directive turns it on, using h2 for TLS or h2c for cleartext. Apache installations fronting TLS by default will usually qualify.
Operators should check the directive before assuming a host is safe, then patch to 2.4.71 rather than relying on a front proxy. Reverse proxies that terminate HTTP/2 themselves push the risk upstream to whichever Apache build answers unencrypted behind them.
Bundled distributions rule. Since RHEL and its rebuilds carry their own patches, verify the version string on each build instead of counting on a single release date.
