RHSA-2026:98981HighCVSS 9.8

Red Hat Security Advisory: mod_http2 security update

Published
November 11, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (2)

CVE-2026-57941 →CVE-2026-119618 →

📋 Description

CVE-2026-57941 — httpd: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy CVE-2026-119618 — httpd:2.4/mod_http2: mod_http2: httpd: Remote code execution in mod_http2

🎯 Affected products14

  • Red Hat Enterprise Linux AppStream (v. 9)
  • mod_http2-0:2.0.26-7.el9_9.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • mod_http2-0:2.0.26-7.el9_9.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • mod_http2-0:2.0.26-7.el9_9.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • mod_http2-0:2.0.26-7.el9_9.1.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • mod_http2-0:2.0.26-7.el9_9.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • mod_http2-debuginfo-0:2.0.26-7.el9_9.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • mod_http2-debuginfo-0:2.0.26-7.el9_9.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • mod_http2-debuginfo-0:2.0.26-7.el9_9.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • mod_http2-debuginfo-0:2.0.26-7.el9_9.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • mod_http2-debugsource-0:2.0.26-7.el9_9.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • mod_http2-debugsource-0:2.0.26-7.el9_9.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • mod_http2-debugsource-0:2.0.26-7.el9_9.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • mod_http2-debugsource-0:2.0.26-7.el9_9.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Disable mod_http2 until a fixed package is installed. In /etc/httpd/conf.modules.d/10-h2.conf, comment out the module and restart the service: #LoadModule http2_module modules/mod_http2.so $ systemctl restart httpd Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (5)