Apache HTTP/2 module critical RCE flaw CVE-2026-119618

Apache HTTP Server's mod_http2 module contains a critical remote code execution vulnerability affecting versions 2.4.55 through 2.4.70. Unauthenticated attackers can execute arbitrary code on servers with HTTP/2 enabled. The flaw is fixed in version 2.4.71 released November 11. Administrators running affected versions should upgrade immediately to patch the vulnerability.