RHSB-2026-017 Remote Code Execution - Apache HTTP Server (CVE-2026-119618)

Executive Summary

A critical remote code execution vulnerability has been discovered in the Apache HTTP Server's mod_http2 module. This issue has been assigned CVE-2026-119618 and has a severity impact of Critical. Fixes are now available for most affected products, and remaining fixes are being expedited. This bulletin will be updated as necessary. Log in with your Red Hat account, then click the "Follow" button below to be notified of changes to this bulletin.

An unauthenticated remote attacker who can send HTTP/2 requests to an affected server can exploit a thread-safety flaw to corrupt the server's internal memory and execute arbitrary commands, potentially gaining full control of the system. No authentication or special privileges are required. Only servers with HTTP/2 enabled (via the Protocols directive) are affected; servers configured to serve HTTP/1.1 only are not vulnerable.

To quickly determine whether this issue is relevant to your environment:

• Check your httpd configuration for a Protocols directive that includes h2 or h2c. If neither is present, the server is not running HTTP/2 and is not vulnerable.
• Verify that mod_http2 is loaded. On RHEL 9 and 10, it ships as a separate mod_http2 package.

Affected Products

The following Red Hat product versions are directly affected:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Red Hat JBoss Core Services 1

Further, any Red Hat product that relies on a Red Hat Enterprise Linux httpd or mod_http2 package is also potentially impacted. Please ensure that the underlying package is current in those environments.

Mitigation

Overall Guidance

Customers can remove HTTP/2 from the Protocols directive in httpd configuration, forcing the server to serve HTTP/1.1 only. This reduces the attack surface until a patched version is deployed.

What Is the Impact of Disabling HTTP/2?

• Compatibility remains unbroken. All modern web browsers and API clients automatically fall back to HTTP/1.1 seamlessly.
• Performance reductions will occur. Page load times will increase because HTTP/1.1 delivers files sequentially instead of using HTTP/2 multiplexing.
• Bandwidth consumption will increase. HTTP/1.1 transmits uncompressed text headers, losing the data savings provided by HTTP/2 HPACK compression.
• Active TCP connections, CPU utilization, and memory usage will rise normally.

Product-Specific Mitigation Steps

Edit your httpd configuration (typically /etc/httpd/conf/httpd.conf or a file under /etc/httpd/conf.d/) and remove h2 and h2c from any Protocols directive, leaving only http/1.1:

Protocols http/1.1

Then restart httpd:

systemctl restart httpd

After applying this change, clients connecting over HTTP/2 will be served HTTP/1.1 instead. This is typically transparent to browsers and standard HTTP clients.

Verification

There are two ways to verify mitigations are in place: client-side or server-side.

Client-Side Validation

Run the following curl header check command locally or externally (adjust URL as needed to target your domain):

curl -kI --http2 https://localhost

• Disabled: The first line of the output returns HTTP/1.1 200 OK.
• Enabled: The first line of the output returns HTTP/2 200.

Server-Side Validation

Run the following commands to verify configurations. Lines starting with # are comments and should be ignored.

• Verify Apache protocols configuration: grep -ri "Protocols" /etc/httpd/conf/httpd.conf /etc/httpd/conf.d/*.conf. Active output lines should not contain h2 or h2c.
• Verify Apache modules configuration: grep http2 /etc/httpd/conf.modules.d/*.conf. Active lines loading the modules should be commented out.

Technical Summary

The mod_http2 module handles concurrent HTTP/2 requests using multiple threads. Due to a thread-safety flaw in the module's handling of these concurrent requests, a worker thread can write into memory owned by the connection thread through a shared, lock-free allocator. This memory corruption can be exploited by a remote attacker to execute arbitrary commands on the server. Because HTTP/2 is designed to allow many simultaneous requests over a single connection, the flaw can be triggered without authentication by any client that can reach the server.

Detection

Check whether HTTP/2 is enabled in your httpd configuration:

grep -r 'Protocols' /etc/httpd/conf/ /etc/httpd/conf.d/ 2>/dev/null

If the output includes h2 or h2c, the server has HTTP/2 enabled and is potentially vulnerable (subject to the installed httpd/mod_http2 package version).

Conditions

The following conditions must be present for this vulnerability to be exploitable:

1. The Apache HTTP Server (httpd) is running with the mod_http2 module loaded.
2. The server configuration includes h2 or h2c in a Protocols directive.
3. The attacker can send HTTP/2 requests to the server (i.e., the server is network-reachable).

No authentication is required. Exploitation is possible from any network client that can reach the server on its HTTP/2 port.

Technical Details

CVE-2026-119618

The mod_http2 module in the Apache HTTP Server (httpd) handles concurrent HTTP/2 requests using worker threads. Each HTTP/2 connection dispatches multiple request streams simultaneously. A thread-safety flaw allows a worker thread to write into memory allocated to the connection thread through a shared allocator that lacks adequate locking. This race condition leads to memory corruption of the server's internal state. A remote attacker can reliably trigger this condition by sending a crafted sequence of concurrent HTTP/2 requests, corrupting memory in a way that allows arbitrary code execution in the context of the httpd server process.

Servers that do not have HTTP/2 enabled (i.e., the Protocols directive does not include h2 or h2c) are not affected by this vulnerability.

Background

The mod_http2 module implements HTTP/2 protocol support for the Apache HTTP Server. HTTP/2 is a binary protocol successor to HTTP/1.1 that introduces request multiplexing over a single TCP connection and is now widely enabled on web servers. On Red Hat Enterprise Linux 9 and 10, mod_http2 ships as a separate package.

Performance Impact

Disabling HTTP/2 (the described mitigation) may have a minor performance impact on clients that benefit from HTTP/2 multiplexing. For most deployments the impact is negligible. The fix, once available, will not require disabling HTTP/2.

References

Apache security advisory

How to use GPG to verify signed content from Product Security