Apache fixes critical HTTP/2 flaw that can allow remote code execution

What Apache fixed in version 2.4.71

On 11 November 2026, Apache released HTTP Server 2.4.71 and published an advisory for CVE-2026-119618, a flaw in mod_http2, the part of Apache that serves HTTP/2 requests. Apache rates it critical. Versions 2.4.55 to 2.4.70 are affected, as are standalone mod_h2 releases 2.0.8 to 2.0.42, according to a summary published by Wordfence on 12 November.

The flaw was reported to Apache on 26 October by Anthropic’s OSS Scanner, and independently on 3 November by researchers at Google Cloud Vulnerability Research. Red Hat describes it as remote code execution that needs no login when HTTP/2 is enabled. A researcher has published tests showing crashes on 2.4.70, but Wordfence found no public demonstration of code execution, and Wiz reported no known attacks in the wild as of 11 November.

Which servers are exposed

Apache is web server software that sits in front of many websites, WordPress sites among them. A successful attack could let someone run their own code with the same privileges as the web server, and so reach the sites and data held on that machine.

Only servers that accept HTTP/2 through the affected module are exposed. Apache uses HTTP/1.1 unless HTTP/2 is switched on in its configuration. A site that offers HTTP/2 to visitors may sit behind a CDN or load balancer that talks to Apache over HTTP/1.1, so what matters is how Apache itself is set up.

Updating WordPress, plugins, themes or a security plugin will not fix this. The fix sits in the server software, which your host controls if you are on shared or managed hosting.

What to ask your host or developer now

The details have been public since 11 November, so treat this as urgent rather than waiting for a routine update.

• On shared or managed hosting, ask your host whether the Apache server behind your site accepts HTTP/2 (h2 or h2c), whether the CVE-2026-119618 fix is installed, and whether Apache was restarted afterwards.
• If you or your developer run the server, install 2.4.71 or your supplier’s fixed package and restart Apache. Operating system, control panel and container suppliers may ship the fix under a different version number, so follow their advisory rather than the number alone.
• If no fix is available yet, have HTTP/2 switched off in Apache until it is, then switch it back on. According to Red Hat, a server that handles only HTTP/1.1 traffic is not at risk from this flaw.
• Make sure you have a recent backup of both the site’s files and its database. It will not prevent an attack, but it helps recovery.

If you are unsure who is meant to apply server fixes, check your software maintenance contract before the next flaw like this. Cognivise offers ongoing support and ownership for businesses with no one clearly responsible for their servers.