Notice on the Apache HTTP Server mod_http2 Vulnerability (CVE-2026-119618)

Overview

On November 11, 2026, the Apache Software Foundation released Apache HTTP Server 2.4.71, fixing a critical vulnerability (CVE-2026-119618) in the HTTP/2 module mod_http2.

The EdgeOne platform is not affected by this vulnerability. Sites served through EdgeOne still require remediation at the origin: requests that trigger the vulnerability are valid at the protocol level and are forwarded to the origin as normal requests.

Vulnerability Details

CVE-2026-119618 is a race condition in mod_http2 when handling HTTP/2 requests. An unauthenticated remote attacker can exploit it to corrupt the memory of the server process and execute arbitrary code. Only Apache HTTP Server installations with HTTP/2 enabled (h2 or h2c) are affected. The affected versions are 2.4.55 through 2.4.70; the fixed version is 2.4.71.

Impact on Services Served Through EdgeOne

EdgeOne edge nodes do not use Apache HTTP Server mod_http2, and platform services are not affected. When HTTP/2 Origin-Pull is enabled, communication between the edge and the origin uses HTTP/2 and requests are forwarded for processing by the mod_http2 module at the origin. When origin-pull uses HTTP/1.1, the origin does not enter that processing path.

Recommended Actions

• Before the upgrade is completed, disable HTTP/2 Origin-Pull in the Rule Engine and set the origin-pull HTTP version to HTTP/1.1. This configuration does not require changes at the origin; once disabled, origin-pull requests no longer enter the mod_http2 processing path.
• Upgrade the origin to Apache HTTP Server 2.4.71, or temporarily disable h2 and h2c at the origin. The origin version fix is the final remediation; edge-side configuration does not replace the upgrade.

Apache HTTP Server Security Advisory (CVE-2026-119618)