RLSA-2026:98981: Important: mod_http2 security update
The modh2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.
Security Fix(es):
httpd: Apache HTTP Server: modhttp2 use-after-free / wild write via shared session->bbtmp re-entrancy (CVE-2026-57941)
httpd:2.4/modhttp2: modhttp2: httpd: Remote code execution in modhttp2 (CVE-2026-119618)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/mod_http2to a version that resolves this vulnerability.Fixed in 0:2.0.26-7.el9_9.1 - Upgrade
Upgrade
rocky-linux/mod_http2-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.0.26-7.el9_9.1 - Upgrade
Upgrade
rocky-linux/mod_http2-debugsourceto a version that resolves this vulnerability.Fixed in 0:2.0.26-7.el9_9.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Rocky Linux systems with the mod_http2 package installed are in scope. The affected module provides HTTP/2 support, including h2 and h2c, for Apache httpd 2.4 servers.
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction.
What impact could successful exploitation have?
The advisory rates the issue critical with a 9.8 score and indicates high impact to confidentiality, integrity, and availability. The listed issues include a use-after-free/wild write condition and remote code execution in mod_http2.