Summary
The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.
Security Fix(es):
* httpd: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy (CVE-2026-57941)
* httpd:2.4/mod_http2: mod_http2: httpd: Remote code execution in mod_http2 (CVE-2026-119618)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | mod_http2 | 0:2.0.26-7.el9_9.1 |
| Rocky Linux · 9 | mod_http2 | 0:2.0.26-7.el9_9.1 |
| Rocky Linux · 9 | mod_http2 | 0:2.0.26-7.el9_9.1 |
| Rocky Linux · 9 | mod_http2 | 0:2.0.26-7.el9_9.1 |
| Rocky Linux · 9 | mod_http2-debuginfo | 0:2.0.26-7.el9_9.1 |
| Rocky Linux · 9 | mod_http2-debuginfo | 0:2.0.26-7.el9_9.1 |
| Rocky Linux · 9 | mod_http2-debuginfo | 0:2.0.26-7.el9_9.1 |
| Rocky Linux · 9 | mod_http2-debuginfo | 0:2.0.26-7.el9_9.1 |
| Rocky Linux · 9 | mod_http2-debugsource | 0:2.0.26-7.el9_9.1 |
| Rocky Linux · 9 | mod_http2-debugsource | 0:2.0.26-7.el9_9.1 |
| Rocky Linux · 9 | mod_http2-debugsource | 0:2.0.26-7.el9_9.1 |
| Rocky Linux · 9 | mod_http2-debugsource | 0:2.0.26-7.el9_9.1 |
Vulnerabilities 2
-
Critical 9.8
Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy
Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
-
High 8.1CVE-2026-119618 Public exploit
Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from G…