RHSA-2026:98953: Important: mod_http2 security update
Published Nov 11, 2026
·Updated
Important: modhttp2 security update
Other sources
The modh2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.Security Fix(es): httpd: Apache HTTP Server: modhttp2 use-after-free / wild write via shared session->bbtmp re-entrancy (CVE-2026-57941) httpd:2.4/modhttp2: modhttp2: httpd: Remote code execution in modhttp2 (CVE-2026-119618) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
8 affected components
Red Hat Red Hat Enterprise Linux for IBM z Systems - 4 years of updates
Red Hat Red Hat Enterprise Linux for x86_64 - 4 years of updates
Red Hat Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Red Hat Enterprise Linux for ARM 64 - 4 years of updates
Red Hat Red Hat Enterprise Linux for Power, little endian - 4 years of support
Event History
Nov 11, 2026
Advisory Published
via Red Hat·01:24 PM
Data Sourced
via Red Hat·01:24 PM
DescriptionSeverityAffected Software