Loading the post…
TL;DR: last updated 2026-11-11 21:33 UTC
CVE-2026-119618 is a flaw in Apache’s HTTP/2 module, mod_http2, that Apache rates critical and says can lead to remote code execution. It affects Apache HTTP Server 2.4.55 to 2.4.70, and only servers with HTTP/2 turned on.
mod_http2 and restart Apache. If you can’t update yet, turn HTTP/2 off. See Update instructions.rpm -q --changelog mod_http2 | grep CVE-2026-119618 prints the fix. See How to verify you are patched.Apache fixed CVE-2026-119618 in Apache HTTP Server 2.4.71, published November 11, 2026. What to do on a CloudLinux server depends on which Apache it runs.
This table covers the system Apache, the one that comes with the operating system: the httpd and mod_http2 packages, or Ubuntu’s apache2 on CloudLinux for Ubuntu. A cPanel server runs EasyApache 4’s Apache instead, whatever the CloudLinux version, so on cPanel go to cPanel servers: EasyApache 4.
To see which Apache a server on CloudLinux 7 to 10 runs:
rpm -qf "$(command -v httpd)"It prints an httpd package for the system Apache and an ea-apache24 package for EasyApache 4. If it reports that the file isn’t owned by any package, that Apache was built outside the CloudLinux packages, and its fix comes from whoever built it.
| CloudLinux version | HTTP/2 module | Affected | Status |
|---|---|---|---|
| CloudLinux 7 | None: Apache 2.4.6 has no HTTP/2 module | No | Nothing to do |
| CloudLinux 8 | mod_http2 1.15.7 | No, the module predates the vulnerable code | Nothing to do |
| CloudLinux 9 | mod_http2 2.0.26 | Yes | Fixed in mod_http2-2.0.26-6.el9_8.2.alma.1. See Update instructions |
| CloudLinux 10 | mod_http2 2.0.29 | Yes | Fixed in mod_http2-2.0.29-4.el10_2.2.alma.1. See Update instructions |
| CloudLinux for Ubuntu 22.04 | Ubuntu’s apache2 2.4.52, which carries mod_http2 2.0.42 | Yes, when the module is turned on (it is off by default) | No fix from Ubuntu yet. See CloudLinux for Ubuntu 22.04 |
The module is also released on its own, with its own version numbers. Apache lists mod_http2 2.0.8 to 2.0.42 as affected.
On CloudLinux 9 and 10, Apache’s HTTP/2 module comes from AlmaLinux’s mod_http2 package, which CloudLinux ships as AlmaLinux builds it. AlmaLinux published the fixed builds on November 11.
The fixed packages are in the stable repositories.
dnf clean metadata
dnf update mod_http2
systemctl restart httpdApache keeps running the old module until it restarts. If dnf reports nothing to do and rpm -q mod_http2 shows a build older than the one in the table, the server’s mirror hasn’t synced the fix yet. Try again later.
First check whether Apache loads the module:
httpd -M 2>/dev/null | grep -w http2_moduleNo output means the module isn’t loaded and the server isn’t exposed. If it prints http2_module (shared), HTTP/2 is on for every site whose Protocols directive lists h2 or h2c. To find those lines:
grep -rEi '^\s*Protocols' /etc/httpd/To turn HTTP/2 off, stop Apache from loading the module, check the configuration and restart:
sed -i 's/^LoadModule http2_module/#LoadModule http2_module/' /etc/httpd/conf.modules.d/10-h2.conf
apachectl configtest
systemctl restart httpdClients then connect over HTTP/1.1. After updating, remove the # from that line and restart Apache to turn HTTP/2 back on.
The package changelog names the fix:
rpm -q --changelog mod_http2 | grep CVE-2026-119618A line naming CVE-2026-119618 means the installed package carries the fix. rpm -q mod_http2 shows the installed build, and the first fixed build for each version is in the table above.
On CloudLinux for Ubuntu 22.04, the system Apache is Ubuntu’s own apache2 package, so its fix comes from Ubuntu. Ubuntu has not released one yet. The HTTP/2 module ships turned off, and Ubuntu’s default configuration offers HTTP/2 as soon as the module is turned on.
To check whether the module is on:
apache2ctl -M 2>/dev/null | grep -w http2_moduleNo output means it is off and the server isn’t exposed. If it prints http2_module (shared), turn the module off and restart Apache:
a2dismod http2
systemctl restart apache2Clients then connect over HTTP/1.1. When Ubuntu releases a fixed apache2, update it with apt-get update && apt-get install --only-upgrade apache2, then turn the module back on with a2enmod http2 if you need it.
cPanel servers run EasyApache 4’s Apache, which CloudLinux rebuilds for CloudLinux 7, 8, 9 and 10 and for CloudLinux for Ubuntu 22.04. The current builds, 2.4.70 (2.4.69 on CloudLinux for Ubuntu), are inside the affected range.
Status: 2026-11-11 21:33 UTC.
CloudLinux is building EasyApache 4 with Apache 2.4.71, which carries the fix, without waiting for cPanel’s own update. There is no release date yet.
To see whether a server has the HTTP/2 module on CloudLinux 7 to 10:
rpm -q ea-apache24-mod_http2On CloudLinux for Ubuntu 22.04, the package is called ea-apache24-mod-http2:
dpkg -s ea-apache24-mod-http2If the command reports that the package is not installed, Apache on that server doesn’t serve HTTP/2 and there is nothing to do.
Otherwise, remove the module until the fixed build is out. In WHM, open EasyApache 4, customize the current profile, switch off mod_http2 under Apache Modules and provision the profile. Or from the command line on CloudLinux 7 to 10 (use yum instead of dnf on CloudLinux 7):
dnf remove ea-apache24-mod_http2
/scripts/restartsrv_httpdOn CloudLinux for Ubuntu 22.04, use purge rather than remove, because remove leaves the module’s configuration file behind and Apache then won’t start:
apt-get purge ea-apache24-mod-http2
/scripts/restartsrv_httpdBrowsers and other clients then connect over HTTP/1.1. Once the fixed build is out, add the module back, in WHM or from the command line. On CloudLinux 7 to 10:
dnf install ea-apache24-mod_http2
/scripts/restartsrv_httpdOn CloudLinux for Ubuntu 22.04:
apt-get install ea-apache24-mod-http2
/scripts/restartsrv_httpdApache’s HTTP/2 module builds the headers of each incoming request. In Apache 2.4.55 to 2.4.70, it can change a request’s headers while another thread is using them (a race condition), which corrupts memory. Apache says this can lead to remote code execution.
The attack is an HTTP/2 request to the server, and Apache names no login or other precondition. Apache rates the flaw critical and has published no CVSS score. It credits Anthropic’s OSS Scanner and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research with the report.
Akos Vajda
Comments