Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

Summary by Cyber Security News12 Nov 2026, 06:12 CET

About this summary. This is a short excerpt from the description that The Hacker News published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html

A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday. Only servers with HTTP/2 enabled are affected, according to Red Hat, which ships the server as part of Red Hat Enterprise Linux.

Read the full article at The Hacker News →

Source attribution: headline and facts are from The Hacker News (thehackernews.com). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

CVE-2026-119618: What We Know About the Critical Apache mod_http2 Race Condition

CVE-2026-119618 | Apache HTTP Server mod_http2 Race Condition Remote Code Execution Vulnerability

PSA: Critical Apache HTTP/2 Vulnerability: What WordPress Site Owners Should Know

Red Hat security advisory (AV26-1136)

Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing

Red Hat security advisory (AV26-1111)