Red Hat Security Advisory: mod_http2 security update

Fixed packages 1

Vulnerabilities 2

• Critical 9.8
  CVE-2026-57941

  Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

  Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Oct 1, 2026
• High 8.1
  CVE-2026-119618 Public exploit

  Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

  Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from G…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine Wolfi
  Nov 11, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2544864
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2567318
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98968.json
• report
  https://access.redhat.com/security/cve/CVE-2026-57941
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-57941
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-57941
• article
  http://www.openwall.com/lists/oss-security/2026/10/01/19
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2026-119618
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2026-017
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-119618
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-119618