Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

A critical vulnerability in the Apache HTTP Server's HTTP/2 module can allow a remote attacker to execute code on the server. The flaw affects Apache HTTP Server versions 2.4.55 through 2.4.70 and has been fixed in version 2.4.71. Only servers with HTTP/2 enabled are vulnerable to this issue. The vulnerability is identified as CVE-2026-119618 and is addressed in the latest version released. Red Hat, which includes the server in Red Hat Enterprise Linux, has noted the vulnerability's existence. An attacker must be able to reach the server to exploit this flaw.