Apache HTTP Server patches critical HTTP/2 remote code execution flaw

Key Points:

• A critical vulnerability (CVE-2026-119618) in the Apache HTTP Server's HTTP/2 module allows unauthenticated attackers to achieve remote code execution (RCE) by exploiting a race condition that corrupts heap memory.
• The flaw affects Apache HTTP Server versions 2.4.55 through 2.4.70 and standalone mod_h2 versions 2.0.8 through 2.0.42, enabling attackers to execute arbitrary code with the web server's privileges.
• Despite a patch being released by the Apache Software Foundation, many servers remain vulnerable and publicly accessible, with telemetry indicating 64% of cloud environments have affected resources, though HTTP/2 must be enabled for exploitation.
• Security researchers urge immediate patching or disabling of HTTP/2 to mitigate risk, as the vulnerability is considered critical and could lead to severe unauthorized access, though no public exploits have been observed yet.
• The latest Apache HTTP Server update also fixes two additional issues: a null pointer dereference in mod_md (CVE-2026-106023) and a low-severity data overwrite flaw in mod_vhost_alias (CVE-2026-109163).