No Login. A 9.8 in Apache HTTP Server.

Apache HTTP Server — the web server behind a huge share of the internet — has a critical flaw that lets a remote attacker run code on the server without logging in. The only requirement is that the server has HTTP/2 turned on. Tracked as CVE-2026-119618, it scores 9.8 out of 10, and the fix is already out: version 2.4.71, released yesterday.

The flaw lives in mod_http2, the module that handles HTTP/2 connections. It affects Apache HTTP Server versions 2.4.55 through 2.4.70. An attacker who can reach the server needs no username, no password, and no account of any kind. Red Hat, which ships the server as part of Red Hat Enterprise Linux, says the attacker “could take full control of the server process.” That process answers every request and often holds the keys to the database behind it.

Only HTTP/2 servers are exposed — check yours

The saving grace is scope. Only servers with HTTP/2 enabled are affected. HTTP/2 runs only where the Protocols directive turns it on, using h2 for HTTP/2 over TLS and h2c for HTTP/2 over plain TCP. It can be set server-wide or per virtual host, so one site can have HTTP/2 on while the rest looks safe. If you run Apache, check the server-wide setting and every virtual host.

The picture varies by distribution. Red Hat shipped fixes for Red Hat Enterprise Linux 9 and 10 yesterday — mod_http2-2.0.26-7.el9_9.1 and mod_http2-2.0.29-5.el10_3.1 — but rates the flaw Important rather than Critical on those releases, because their mod_http2 packages give each HTTP/2 stream its own memory allocator, which makes an attack much harder. Red Hat Enterprise Linux 8 and earlier do not contain the vulnerable code at all. Debian has the fix in unstable (apache2 2.4.71-1), while bookworm, trixie, and forky are still listed as vulnerable. Amazon Linux 2, Amazon Linux 2023, and the 2027 preview are pending a fix, and Ubuntu had no status page for the flaw when The Hacker News checked today.

There is also a corner with no fix coming. Standalone builds of the module, released on GitHub as mod_h2, are affected from version 2.0.8 through 2.0.42 — and the project has published no fixed release. Its repository has been read-only since it was archived on June 9. If you run those builds, the only move is the mitigation below.

Is there an exploit? Two answers, both worth hearing

Red Hat’s assessment, published yesterday, says “public research has demonstrated a reliable exploit” against a server in its default configuration with mod_http2 enabled. It does not name or link that research. Security company Wiz said later the same day that no exploit was available and that no exploitation in the wild had been reported. A reliable exploit may exist in private research while no public exploit and no observed attacks exist yet. That is usually the quietest moment in a flaw’s life — and the moment to patch in.

The flaw was reported on October 26 by Anthropic’s OSS Scanner, a free scanning service for open-source projects that uses the company’s AI models. Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported it last week. It is not Apache’s first HTTP/2 problem: an earlier flaw, CVE-2026-23918, was fixed in version 2.4.67, released on May 4. Servers that updated to that release — or to any later one up to 2.4.70 — still run a version the new flaw affects. Patching the last one did not save you from this one.

The pattern will be familiar to anyone who has followed the recent run of unauthenticated remote flaws — the Linux kernel TCP flaw that gave root with no login and the OpenSSH flaw that went from patch to confirmed break-ins in days. The lesson from both is the same: the gap between disclosure and exploitation is measured in days, sometimes hours.

What to do now

Update to Apache HTTP Server 2.4.71. The same release also fixes a crash in mod_md and a one-byte overwrite of stack memory in mod_vhost_alias — worth taking even if you never enabled HTTP/2. Distribution builds: RHEL 9 and 10 fixes are out now, Debian unstable has it, and the rest are landing.

If you cannot update yet, the Apache advisory offers no workaround — but Wiz advises removing h2 and h2c from the Protocols directive, leaving Protocols http/1.1. That turns HTTP/2 off and closes the hole, at the cost of the performance HTTP/2 brings. Do it on the server-wide setting and on every virtual host, and remember it applies to the standalone mod_h2 builds too, since no fixed release exists for them.

Then verify: check the version your server reports, confirm HTTP/2 is off where it should be, and watch for your distribution’s package if it is still pending. A 9.8 with no login required and a fix already published is the easiest kind of emergency to handle — as long as it is handled before the exploit stops being private.

The window is open now

Right now there is no public exploit and no reported exploitation in the wild. That is the best position to be in with a 9.8 — a fix published, a mitigation available, and time to use both. That position does not last. Patch the server, or switch HTTP/2 off, before someone else decides the timing for you.