RLSA-2026:98978: Important: mod_http2 security update
The modh2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.
Security Fix(es):
httpd: Apache HTTP Server: modhttp2 use-after-free / wild write via shared session->bbtmp re-entrancy (CVE-2026-57941)
httpd:2.4/modhttp2: modhttp2: httpd: Remote code execution in modhttp2 (CVE-2026-119618)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/mod_http2-debugsourceto a version that resolves this vulnerability.Fixed in 0:2.0.29-5.el10_3.1 - Upgrade
Upgrade
rocky-linux/mod_http2-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.0.29-5.el10_3.1 - Upgrade
Upgrade
rocky-linux/mod_http2to a version that resolves this vulnerability.Fixed in 0:2.0.29-5.el10_3.1
Event History
Frequently Asked Questions
What attacker access is required to exploit these issues?
The reported CVSS vector indicates network-reachable exploitation with low attack complexity. No privileges or user interaction are required.
Which systems should be prioritized for remediation?
Prioritize Rocky Linux systems with the mod_http2, mod_http2-debuginfo, or mod_http2-debugsource packages, particularly where Apache HTTP Server is using mod_http2 to provide HTTP/2 or h2c service.
What is the expected impact of successful exploitation?
The advisory rates the issues critical at 9.8 and indicates high impact to confidentiality, integrity, and availability. It also identifies a remote code execution issue and a use-after-free/wild-write issue in mod_http2.