Apache HTTP/2 Flaw CVE-2026-119618: QUAPE Customers Protected

On 11 November 2026 the Apache Software Foundation released Apache HTTP Server 2.4.71 to fix CVE-2026-119618, a critical Apache HTTP/2 flaw that can let an attacker run code on a web server without logging in. It is rated 9.8 (Critical) on CVSS v3.1 and affects Apache 2.4.55 through 2.4.70 whenever HTTP/2 is enabled, which is the default on most modern hosting stacks.

QUAPE has protected all our customers by disabling HTTP/2 on our hosting servers while we wait for the Linux distributions to release their backported fixes. With HTTP/2 off, the vulnerable code cannot be reached. This article explains what the Apache HTTP/2 flaw is, who is affected, and what customers who manage their own servers must do now.

The short version

Any Apache HTTP Server from 2.4.55 to 2.4.70 that serves HTTP/2 is exposed. The fix is Apache 2.4.71 or your distribution's patched package. QUAPE has disabled HTTP/2 on all shared, WordPress and managed hosting servers until the distribution patches are installed, so customers on those services are protected and need to do nothing. VPS, dedicated and colocation customers who run Apache must update it themselves, or disable HTTP/2 until they can.

What is CVE-2026-119618?

The flaw is in mod_http2, the Apache module that speaks HTTP/2. HTTP/2 lets a browser send many requests over one connection at the same time, and Apache handles them with several threads working in parallel. In the function that assigns request headers, two of those threads can touch the same memory without proper locking. This is a race condition, and when an attacker wins the race the server's memory is corrupted.

The Apache advisory, titled “mod_http2: heap corruption and RCE in assign_headers”, rates the issue Critical because that corruption can be steered into remote code execution with the privileges of the web server. A failed attempt may simply crash an Apache worker, so the same Apache HTTP/2 flaw is also a denial-of-service risk.

No login is needed. The attacker only has to reach a port where Apache negotiates HTTP/2. Internal reverse proxies and management interfaces count, not just public websites.
Only HTTP/2 is affected. Servers limited to HTTP/1.1 are not exposed. Other web servers such as nginx and LiteSpeed do not use this module.
It was found twice. The bug was reported to Apache on 26 October 2026 by Anthropic's OSS Scanner and again, independently, on 3 November by Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research.

At the time of writing there are no confirmed reports of attacks in the wild. However, a third-party proof of concept that reproduces the memory corruption was published on 12 November, and Red Hat notes that public research has shown reliable exploitation against a default configuration. We expect working exploits to follow quickly.

Which versions are affected and which are fixed?

Software	Affected	Fixed in
Apache HTTP Server	2.4.55 through 2.4.70, with HTTP/2 enabled	2.4.71 (11 November 2026)
Standalone mod_h2 (GitHub)	2.0.8 through 2.0.42	Move to a patched Apache HTTP Server
Apache 2.4.54 and older	Not affected by this flaw, but end of the line for other fixes	Upgrade recommended

Linux distributions backport the fix into their own packages, so the version number may not read 2.4.71. Status at the time of writing:

Distribution	Status
Debian 13	Fixed: apache2 2.4.71-1~deb13u1 (DSA-6620-1)
Debian 12	Fixed: apache2 2.4.71-1~deb12u1 (DLA-4902-1)
Ubuntu	Security notice USN-9090-1 issued 12 November 2026; check the Ubuntu tracker for your release
RHEL, AlmaLinux, Rocky Linux 9 and 10	Affected; fixed mod_http2 packages released from 11 November 2026
RHEL 8 and older	Not affected

Apache 2.4.71 also fixes two smaller issues, CVE-2026-106023 in mod_md and CVE-2026-109163 in mod_vhost_alias, so the same update covers all three.

What QUAPE has done

The Apache HTTP/2 flaw can only be reached over HTTP/2, so we are disabling HTTP/2 across all QUAPE shared, WordPress and managed hosting servers while we wait for the backported fix from the Linux distributions. This protects every customer on those services now, without waiting for each vendor's package.

Your website keeps working. Browsers fall back to HTTP/1.1 automatically. Nothing changes for visitors, logins, checkouts or email. Pages with many images or scripts may load slightly more slowly for the time being.
It is temporary. As each distribution releases its patched Apache package, we install it and turn HTTP/2 back on.
No action is required from customers on these services.

What you need to do

Shared, WordPress and managed hosting customers

Nothing. HTTP/2 is disabled on your server until the patch is installed, which removes the exposure. We will re-enable it once the fixed package is in place.

VPS, dedicated server and colocation customers

You manage the software on these services, so if you run Apache you must update it yourself as a matter of urgency:

Check your version with apachectl -v or httpd -v, and check whether HTTP/2 is loaded with apachectl -M | grep http2.
Install the fixed package: apt update && apt upgrade on Debian and Ubuntu, or dnf upgrade on RHEL-family systems. If you build Apache from source or use a control panel's own build, move to 2.4.71.
Restart Apache so that every worker runs the new code, for example systemctl restart apache2 or systemctl restart httpd. A reload is not enough.
If you cannot patch today, apply the interim measure below.

If you would like QUAPE to patch a server for you, open a support ticket from your account and our engineers will schedule it.

Interim measure: disable HTTP/2

Apache publishes no workaround, but the flaw cannot be reached when HTTP/2 is switched off. This is the same measure we are using on our own platform. Restrict the server to HTTP/1.1 in the main configuration and in every virtual host that sets its own Protocols line, then restart Apache:

Protocols http/1.1

Keep in mind:

Remove every h2 and h2c entry. One virtual host that still lists them leaves the server exposed.
Websites keep working, but pages may load a little more slowly until HTTP/2 is turned back on.
This is a stopgap, not a fix. Re-enable HTTP/2 only after the patched package is installed and Apache has been restarted.

Has QUAPE been affected?

We have no indication of compromise on our platform, and there are no confirmed reports of exploitation anywhere at the time of writing. If you notice unexpected Apache crashes, unfamiliar files or processes, or unusual outbound traffic on a server you manage, treat it as suspicious and contact support so we can investigate with you.

Timeline

26 October 2026: the flaw is reported to the Apache security team by Anthropic's OSS Scanner.
3 November 2026: Google Cloud Vulnerability Research reports the same flaw independently.
11 November 2026: Apache HTTP Server 2.4.71 is released and CVE-2026-119618 is published.
12 November 2026: distribution updates follow, and a third-party proof of concept appears.
QUAPE: HTTP/2 disabled across our hosting platform as protection while distribution backports are released. We will update this article when the patched packages are installed and HTTP/2 is back on.

Questions

If you are unsure whether your server runs Apache or which version it has, open a support ticket from your account and we will tell you. For anything else related to this advisory, reply to the notification email or contact our team.

References: Apache HTTP Server 2.4 security advisory for CVE-2026-119618 (11 November 2026); NVD entry CVE-2026-119618; Red Hat security bulletin RHSB-2026-017; Debian advisories DSA-6620-1 and DLA-4902-1; Ubuntu security notice USN-9090-1.