A critical vulnerability (CVE-2026-119618) in the Apache HTTP Server’s HTTP/2 module, mod_http2, allows unauthenticated remote attackers to execute code on affected servers running versions 2.4.55 through 2.4.70. The flaw, fixed in version 2.4.71, requires HTTP/2 to be enabled and has a CVSS score of 9.8; administrators are urged to update or disable HTTP/2 protocols to mitigate the risk.
https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html