CSIRT Centrum e-Zdrowia published an advisory for the critical CVE-2026-119618 vulnerability in Apache HTTP Server. The flaw affects HTTP/2 handling and may corrupt httpd process memory, potentially leading to unauthenticated remote code execution. The CVSS 3.1 score is 9.8.

Source: CSIRT Centrum e-Zdrowia. This post is an operator checklist: version inventory, HTTP/2 exposure, patching and temporary risk reduction.

Who is affected

Potentially affected installations:

  • Apache HTTP Server 2.4.55 to 2.4.70
  • mod_h2 2.0.8 to 2.0.42

The highest risk is where Apache serves public HTTPS traffic with HTTP/2 enabled. This includes internet-facing servers and hosts behind a reverse proxy if HTTP/2 terminates on the vulnerable httpd.

If a CDN or load balancer sits in front of the application, still check the origin. Some environments also enable HTTP/2 on the backend connection or on a separate administrative hostname.

What is known

According to the CSIRT CEZ notice, an error in the HTTP/2 implementation allows specially crafted network packets to be sent to the server. Exploitation does not require an account, user interaction or previous access. The vector is network-based and low complexity.

Potential impact includes takeover of the web server process, access to data processed by the application, modification of that data and service disruption. The full CVSS vector from the notice is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

What to check now

On every Apache host:

apachectl -v 2>/dev/null || httpd -v
apachectl -M 2>/dev/null | grep -Ei 'http2|h2' || httpd -M 2>/dev/null | grep -Ei 'http2|h2'
rpm -q httpd mod_http2 2>/dev/null || true
dpkg -l 'apache2*' 'libapache2-mod-*' 2>/dev/null | grep -Ei 'apache2|http2|h2' || true

Record the result next to the application name, hostname, public exposure and where TLS and HTTP/2 terminate. Prioritise servers that accept internet traffic directly or through a load balancer.

Patch and workaround

The target fix is Apache HTTP Server 2.4.71 or later. On Linux distributions, the package version may not match the upstream number if the vendor backported the fix. Check the distribution advisory and package changelog, not only httpd -v.

If the patch cannot be deployed immediately, consider temporarily disabling HTTP/2 on the vulnerable server and keeping HTTP/1.1 until the fix is applied. Example Apache configuration:

Protocols http/1.1

After the change, test the configuration and reload or restart during a maintenance window:

apachectl configtest
systemctl reload apache2 || systemctl reload httpd

This is an operational workaround, not a patch. It may change client and reverse-proxy behaviour, so application testing is required.

Monitoring after the change

After patching or disabling HTTP/2, check Apache error logs, process restarts and unusual worker exits. Add alerts for higher 5xx rates, httpd restarts and process memory fault messages.

A vulnerability scan should confirm the fixed state, but on the day of the advisory it does not replace manual package verification. A WAF and CDN can limit some traffic, but they do not replace patching the vulnerable Apache origin.

Operations and response layer: security. Server updates and change windows: IT administration.

In short: CVE-2026-119618 is a critical HTTP/2 vulnerability in Apache HTTP Server, CVSS 9.8. Check where you run httpd with HTTP/2, update to 2.4.71 or a distribution package with the fix, and if you must wait for a window, consider temporarily disabling HTTP/2.