Critical Apache HTTP/2 Flaw Allows Unauthenticated Remote Code Execution
A critical vulnerability tracked as CVE-2026-119618 has been identified in the Apache HTTP Server's mod_http2 module, affecting versions 2.4.55 through 2.4.70. The flaw enables remote attackers to execute arbitrary code on affected servers without any authentication, potentially granting full control over the server process. It carries a CVSS score of 9.8 and impacts only systems with HTTP/2 enabled via the Protocols directive using h2 or h2c. Red Hat has released fixes for Enterprise Linux 9 and 10, while the Apache project issued version 2.4.71 to address the issue along with two additional lower-severity bugs. The vulnerability was discovered by Anthropic's OSS Scanner and reported by researchers from Google Cloud Vulnerability Research. Earlier related flaws such as CVE-2026-23918 remain relevant for servers not updated beyond version 2.4.67.
The Hacker NewsNov 12, 2026Translated from English