Apache CVE-2026-119618: check if HTTP/2 is enabled and turn it off

A critical mod_http2 flaw in Apache 2.4.55 through 2.4.70, fixed in 2.4.71. How to check whether your server loads mod_http2, on a plain install, RunCloud and ServerPilot, and how to switch it off until you can patch.

Apache released 2.4.71 on November 11 to fix CVE-2026-119618, a critical flaw in mod_http2 that can lead to remote code execution. Versions 2.4.55 through 2.4.70 are affected. Details are on the Apache 2.4 vulnerabilities page (opens in a new tab).

A server is exposed only when all three are true:

  • Apache is 2.4.55 through 2.4.70
  • mod_http2 is loaded
  • a Protocols line offers h2 or h2c

A server that only speaks HTTP/1.1 never reaches the vulnerable code. So if you can’t upgrade today, turning HTTP/2 off closes the hole.

Check the version

Terminal window
apachectl -v

One of my dev servers, on Ubuntu 24.04, reported Apache/2.4.58, inside the affected range.

Distributions backport fixes without bumping the upstream version, so on a distro package the version string alone doesn’t tell you whether you’re patched. Check your distribution’s security tracker for a fixed package. At the time of writing, Ubuntu had no fix out yet for 24.04 or 22.04.

Check if mod_http2 is loaded

The command depends on how Apache was installed:

Terminal window
# Plain Debian/Ubuntu install
apache2ctl -M | grep http


# RunCloud
apachectl -M | grep http


# ServerPilot
/opt/sp/apache/bin/apachectl -M | grep http

If http2_module (shared) shows up in the output, the module is loaded.

Turn it off on RunCloud

RunCloud keeps its Apache config in /etc/apache2-rc/. Find where the module is loaded and where Protocols is set:

Terminal window
grep -RnE 'http2_module|^\s*Protocols' /etc/apache2-rc/

On my server:

/etc/apache2-rc/original/httpd.conf:140:#LoadModule http2_module modules/mod_http2.so
/etc/apache2-rc/httpd.conf:89:LoadModule http2_module modules/mod_http2.so

The copy under original/ is already commented out. The live one is httpd.conf, line 89. Comment it out:

Terminal window
vi /etc/apache2-rc/httpd.conf
#LoadModule http2_module modules/mod_http2.so

Test the config, then reload:

Terminal window
apachectl configtest
service apache2-rc reload
service apache2-rc status
apachectl -M | grep http

configtest must say Syntax OK before you reload. Afterwards http2_module should be gone from the module list.

A leftover Protocols h2 ... line can stay. Without the module nothing can speak h2, so Apache serves HTTP/1.1.

Turn it off on a plain Debian/Ubuntu install

Terminal window
a2dismod http2
apache2ctl configtest
systemctl reload apache2
apache2ctl -M | grep http

What you lose

Browsers fall back to HTTP/1.1, which is a bit slower on pages with many assets. If the site sits behind Cloudflare, visitors still get HTTP/2 or HTTP/3 from the edge, since Cloudflare talks to the origin over HTTP/1.1 by default anyway.

Once your distribution ships the fix, or you’re on 2.4.71, uncomment the line and reload.