Critical Apache HTTP/2 Flaw CVE-2026-119618

tstrand

https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html

From what I understand running Ubuntu 24.04 and up with HTTP/2 enabled leaves you vulnerable to this.
Ubuntu doesn't even have a CVE status page for this yet.

Is it recommended to turn off
a2dismod proxy_http2 http2

Or do Adam have any other advice?

jwaibel

you could just uncomment the http2 line in the apache2.conf and restart the apache server.

MarkD

jwaibel Yes, that's what we have done like this

sed -i 's/^Protocols h2 http\/1\.1$/Protocols http\/1.1/' /etc/apache2/apache2.conf
apache2ctl configtest
systemctl reload apache2

As long as you get "Syntax OK" after the configtest command you are all good to run the last command, you can ignore the "ServerName" warning

enhance_dan

So the Apache version I'm seeing in Enhance is:
ServerVersion: Apache/2.4.58 (Ubuntu) OpenSSL/3.0.13
Is updating to 2.4.71 something we'll have to wait on Ubuntu to add to their default package repositories, or is the web server version something that the Enhance team controls and can push out?

MarkD

enhance_dan It wont come out as 2.4.71 but yes we are waiting for Ubuntu to back port the fix into 2.4.58

You can see the version we are all running here along with the back ported fixes so far
https://www.ubuntuupdates.org/package/core/noble/universe/updates/apache2

Adam

enhance_dan Is updating to 2.4.71 something we'll have to wait on Ubuntu to add to their default package repositories, or is the web server version something that the Enhance team controls and can push out?

Enhance installs the package from Ubuntu. They should be quick with the backported patch - if they're not we may have to release our own package to replace it.

Disabling http2 is a good mitigation in the meantime if you're not using it.

nick-a

Just out of interest, when you consider Ubuntu's response and delays in dealing with CVEs these days, especially kernel ones, would it make sense to maybe support Debian too, the patches seem far quicker to me, and it would be a lot less effort that supporting a yum based distro?

Adam

nick-a

Possibly yes but also we are still planning to support Almalinux in the future.

Omar

Heads up: Ubuntu has shipped the backported fix for noble.

apache2 2.4.58-1ubuntu8.19 includes CVE-2026-119618 in its changelog. Confirmed on our Enhance nodes after a regular apt upgrade.

To verify on your servers:

dpkg-query -W apache2-bin
zgrep -c "CVE-2026-119618" /usr/share/doc/apache2-bin/changelog.Debian.gz

The first should show 8.19 or higher, the second a count of 1 or more.

Also make sure the running Apache process is the new binary, not the old one still in memory:

sudo ls -l /proc/$(pgrep -o apache2)/exe

If it ends in "(deleted)", restart Apache.

Once patched, anyone who disabled h2 as a mitigation can re-enable it.