# Apache HTTP/2 vulnerability CVE-2026-119618: what should you do?

> CVE-2026-119618 may allow code execution in Apache. Find out how to clarify whether you are affected, which packages are patched and what to do next with your hosting provider.

- Quelle: https://bezahlbare-webseite.de/en/ratgeber/apache-http2-rce-was-tun/
- Datum: 2026-11-12
- Sprache: en
- Thema: Technik & Sicherheit

A critical vulnerability in Apache’s HTTP/2 module has been public since 11 November 2026. CVE-2026-119618 may allow third-party code to run on the server. WordPress sites, online shops and static business websites may also be hosted on affected servers. Ask your hosting provider to check today. An up-to-date CMS alone does not tell you whether the server has been patched. Research as of: 12.11.2026.

## What happened?

Apache is web server software. The [Apache security advisory dated 11.11.2026](https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-119618) describes CVE-2026-119618 as critical; version 2.4.71 fixes it. Concurrent requests can cause the `mod_http2` module to corrupt memory. This potentially allows remote code execution, or RCE.

[Red Hat assigns a score on 11.11.2026](https://access.redhat.com/security/cve/cve-2026-119618) of 9.8 under CVSS v3.1. The research supports this numerical rating only for Red Hat. It does not establish a separate numerical score from Apache or NVD.

The older CVE-2026-93546 concerns WebDAV in the `mod_dav_fs` module and was published on 01.10.2026. Authenticated write access can trigger process crashes and corruption of the WebDAV property database. The [Apache CVE record for WebDAV](https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/93xxx/CVE-2026-93546.json) describes this separate vulnerability.

## How dangerous is it really?

According to Red Hat, a network attack is possible without authentication or user interaction. It requires reachable vulnerable module code and `h2` or `h2c` to be enabled: HTTP/2 with or without transport encryption, respectively. Whether code execution succeeds also depends on memory management. RCE is not guaranteed on any particular installation.

As of 12.11.2026, the sources reviewed contain no reliable confirmation from primary sources of attacks in the wild. This does not prove that no attacks are taking place. The research also provides no reliable figures on attempted attacks.

There is an unresolved contradiction regarding a public exploit: [Red Hat](https://access.redhat.com/security/cve/cve-2026-119618) reports public research with a reliable exploit in a default configuration with the module enabled, but does not link to specific evidence. [Wiz](https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability) writes on 11.11.2026 that no exploit was available at the time of publication. A working public proof of concept, or PoC, was not verified during the research. A research demonstration does not in itself establish that a website has been compromised.

## Which versions fix the vulnerability?

The following fix information applies only to this CVE. Vendors may apply fixes to older package versions; this is called backporting. The full package/build identifier and the corresponding security advisory are what matter. A separately installed HTTP/2 module must also be included in the check.

- Apache upstream: unmodified original versions from 2.4.55 up to and including 2.4.70 are affected; 2.4.71 contains the fix. Standalone `mod_h2` 2.0.8–2.0.42 is also affected. Source: [release notes dated 11.11.2026](https://downloads.apache.org/httpd/CHANGES_2.4.71). A fixed standalone module version was not verified in the [module releases](https://api.github.com/repos/icing/mod_h2/releases?per_page=3) as of the research date.
- RHEL 9: `mod_http2-2.0.26-7.el9_9.1` is confirmed as fixed under [RHSA-2026:98981 dated 11.11.2026](https://access.redhat.com/errata/RHSA-2026:98981). This finding applies to the named product; it cannot be extended to AlmaLinux or Rocky Linux without separate evidence.
- Debian: the [Security Tracker](https://security-tracker.debian.org/tracker/CVE-2026-119618), accessed on 12.11.2026, lists sid with `apache2 2.4.71-1` as fixed. bookworm, trixie and forky were marked as vulnerable there. This snapshot does not replace current confirmation for the package in use.
- Plesk/cPanel and Shared Hosting: no universally safe panel version has been established. The [EasyApache changelog dated 11.11.2026](https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/) lists `ea-apache24 2.4.70` under 25.95; a specific fix for this CVE was not verified there. This does not justify a blanket assessment of a hosting provider’s patch status. Ask which packages are actually in use and whether any fixes have been backported.

## How can you check whether your website is affected?

Visible information provides clues. To determine whether your website is affected, the operator needs access to packages and configuration.

- WordPress: Tools → Site Health → Info → Server shows server information where available. The [web server field](https://developer.wordpress.org/reference/classes/wp_debug_data/get_wp_server/) does not check backports, module versions or every server in front of the origin. A green Site Health status does not confirm protection against this CVE.
- Browser: open the developer tools, go to [Network](https://developer.chrome.com/docs/devtools/network/reference/) and show the Protocol column. `h2` for the document request indicates HTTP/2 on that connection. If there is an intermediary service (CDN), you initially see the connection to that service. The display does not reveal an Apache version; a different protocol value does not rule out HTTP/2 behind it either.
- Plesk/cPanel: with [Plesk](https://docs.plesk.com/en-US/obsidian/administrator-guide/web-servers/apache-and-nginx-web-servers-linux/plesk-for-linux-http2-support-in-plesk.76461/), the visible HTTP/2 connection may be to nginx. With [cPanel](https://docs.cpanel.net/ea4/apache/apache-modules/apache-module-http2/), the administrator manages the module through WHM → Software → EasyApache. The panel name and TLS certificate do not establish patch status. If you do not have administrative access, your hosting provider carries out the check.
- SSH: your technical support team can check the version with `apachectl -v` and the modules with `apachectl -M`; the program may have a different name depending on the installation. The output proves neither that fixes have been backported nor that running processes have been updated. Full package identifiers and the active protocol configuration are also required.

## What should you write to your hosting provider?

Copy this text and add your domain:

“Hello, please check my domain [DOMAIN] for CVE-2026-119618. Which web servers and intermediary services process the requests? Please provide the operating system release and package source, along with the full package/build identifiers for Apache and its HTTP/2 module. Has the vulnerability been fixed? Please send the relevant vendor security advisory. Is `mod_http2` loaded, and where are `h2` or `h2c` active, including behind intermediary services or via direct access? After the update, please confirm that all Apache instances have been fully restarted, with no old processes still running. If the patch is still pending, which verified temporary measure is in place, and when will the update follow? Thank you.”

We recommend a full restart for operational reasons based on the [Apache documentation](https://httpd.apache.org/docs/2.4/stopping.html). With a “graceful” restart, existing requests continue running initially. This request is not a special requirement quoted from the CVE advisory. A response such as “everything is up to date” lacks specific evidence.

## What if the update cannot be applied immediately?

The patch is the preferred solution. As a temporary technical measure, [Wiz](https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability) recommends disabling `h2` and `h2c`. The operator must check the configuration and confirm that they have been disabled for all affected websites and direct server access routes. Apache does not specify its own workaround in the advisory reviewed.

This change belongs in the server configuration. Individual website configurations can override global protocol settings; `.htaccess` is not intended for this purpose. HTTPS must remain enabled: unencrypted HTTP/2 also exists, so disabling transport encryption does not remove the cause.

A Web Application Firewall (WAF) or Cloudflare does not offer a blanket guarantee of protection. [Cloudflare also supports HTTP/2 to the origin server](https://developers.cloudflare.com/speed/optimization/protocol/http2-to-origin/). Specific WAF protection against this CVE was not verified. Have the actual connection path and direct server access routes checked.

If neither patching nor verified protocol disabling is possible, we recommend restricting network access to the vulnerable service or taking it temporarily out of operation as a last operational option. A WordPress maintenance page does not stop the server from processing HTTP requests.

## Frequently asked questions about the Apache HTTP/2 vulnerability

### WordPress and plugins are up to date – is that enough?

No. The vulnerability is in the Apache module. CMS updates do not fix this flaw. Also ask for confirmation that the server has been patched.

### Does Cloudflare protect me?

That alone is not enough to determine whether you are protected. What matters is the protocol used to connect to the origin server and whether it can be reached directly. Have the configuration and Apache patch status checked.

### Can this affect my static website?

A static website can also run on an affected Apache server. A CMS or PHP is not a prerequisite. The operator must check whether your particular website is affected.

### My browser shows HTTP/2 – am I vulnerable?

The display only establishes the protocol used for that connection. It reveals neither the server behind a CDN nor its package version. Ask your hosting provider.

### Is an Apache version below 2.4.71 automatically vulnerable?

No. A vendor backport can fix the vulnerability even if an older version is displayed. Request the full package/build identifier together with the security advisory. Module code and active protocols also determine the attack path.

### Has the vulnerability already been exploited?

As of the research date, 12.11.2026, there is no reliable confirmation from primary sources of attacks in the wild. The conflicting statements about a public exploit do not establish that such attacks have occurred.

---
Veröffentlicht von bezahlbare-webseite.de — Website im Abo ab 79 €/Monat. https://bezahlbare-webseite.de/