Update Apache HTTP Server for Critical Vulnerability

This message is intended for U-M IT staff responsible for university systems running Apache HTTP Server.

Summary

CVE-2026-119618 is a critical vulnerability in Apache HTTP Server’s mod_http2 module that can allow unauthenticated remote code execution on affected servers with HTTP/2 enabled.

Administrators of affected servers that are not managed by ITS need to update affected upstream Apache HTTP Server releases to 2.4.71 or apply vendor-supplied patches as soon as possible after appropriate testing. The need for immediate action supersedes the remediation timeframes in Vulnerability Management (DS-21).

ITS is applying critical security updates to MiServer managed servers starting at noon on November 12.

Problem

A thread-safety flaw in concurrent HTTP/2 request handling can corrupt server memory and allow a remote attacker to execute commands without authentication. Servers configured to serve only HTTP/1.1 are not affected, according to Red Hat. 

Threats

Successful exploitation could allow arbitrary command execution with control of the server process, access to or modification of sensitive information, and service disruption. No exploitation in the wild has been reported, but Apache states that public research demonstrated a reliable exploit.

Affected Systems

Apache identifies affected Apache HTTP Server releases as 2.4.55 through 2.4.70, and affected standalone mod_h2 releases as 2.0.8 through 2.0.42. HTTP/2 must be enabled for exposure.

Patches for Red Hat are available and need to be installed immediately.

As of the time of this alert, Ubuntu and other Linux distributions have not yet posted status pages or released patches. If running those systems, please monitor vendor releases and be sure to apply patches as soon as possible.

Units administering Windows hosts running Apache should monitor for releases as well.

Detection

For exposure assessment, check the installed Apache/mod_http2 package and vendor patch status, and inspect HTTP/2 enablement across server-wide and virtual-host configuration. Version checks alone may not account for vendor backported fixes.

Action Items

Identify Apache servers with HTTP/2 enabled, including server-wide and virtual-host Protocols settings containing h2 or h2c.

Patch affected servers that are not managed by ITS as soon as possible after appropriate testing. Update affected upstream releases to Apache HTTP Server 2.4.71, or apply the distribution vendor’s security update addressing CVE-2026-119618.

If patching is not immediately possible, consider temporarily disabling HTTP/2 after assessing service impact. Red Hat states HTTP/1.1-only servers are not vulnerable; The Hacker News reports mitigation by removing h2 and h2c from Protocols settings.

Technical Details

Apache describes improper synchronization of a shared resource in mod_http2’s assign_headers() function, leading to heap corruption and possible remote code execution. Red Hat explains that a worker thread writes into memory owned by the connection thread through a shared, lock-free allocator. RHEL 9 and 10 use separate stream allocators, increasing exploitation complexity.

How We Protect U-M

The ITS MiServer team is patching managed MiServers starting at noon on November 12. If you administer an unmanaged MiServer, please be sure to patch immediately.

Information for Users

Users may briefly lose access to applications, websites, or other services hosted on servers while updates are being applied.

Questions, Concerns, Reports

Please contact ITS Information Assurance through the ITS Service Center.