Apache mod_http2 Critical RCE (CVE-2026-119618): Are You Exposed, and How to Fix It

What this session covers

A server that reports Apache 2.4.70 with HTTP/2 enabled was a normal, modern setup until this week. CVE-2026-119618 is a heap-corruption flaw in the mod_http2 module of Apache httpd that can lead to remote code execution. It affects 2.4.55 through 2.4.70 and is fixed in 2.4.71. In this session we rebuild the situation in our isolated lab and go through the response the way a defender needs it: what the bug is, whether a given server is exposed, and what to do this week.

The session follows four steps. We first answer the exposure question in seconds: the module has to be loaded and HTTP/2 has to be offered, and both must be true. We then look at where the bug lives, using the one-line public fix in assign_headers(). The third step buys time without patching by serving HTTP/1.1 only with a graceful reload and no downtime. The last step is the patch, followed by proof that the problem is actually gone. We close with a short checklist you can run today.

Key takeaways

• Two conditions, both required. A server is exposed only when mod_http2 is loaded and HTTP/2 is actually offered to clients. Check both before deciding on urgency.
• The outside view lies. From the network, a vulnerable server and a patched one look identical. Only the version and the package patch level tell the truth.
• Do not trust httpd -v alone. Distributions back-port fixes without changing the upstream version string, so check the package changelog as well.
• HTTP/1.1 only is a stopgap. Disabling HTTP/2 with a graceful reload buys time safely, but it is not a cure.
• Patch, then prove it. Move to 2.4.71 or your distribution's fixed build and confirm the result with curl.

About the lab

Everything in the video runs in an isolated lab with no internet access. The exploit itself is not shown or discussed in reproducible detail; this is a defensive walkthrough only. The commands shown are standard administration checks that you can run on your own servers.