Fixed EasyApache 4 builds are now in the stable repositories for cPanel servers on CloudLinux 7, 8, 9 and 10 and on CloudLinux for Ubuntu 22.04. ea-apache24 and ea-apache24-mod_http2 version 2.4.71-1~urgent resolve CVE-2026-119618.
On CloudLinux 7, 8, 9 and 10: yum update ea-apache24 /scripts/restartsrv_httpd
On CloudLinux for Ubuntu 22.04: apt-get update && apt-get install --only-upgrade ea-apache24 /scripts/restartsrv_httpd
If you removed the HTTP/2 module as a workaround, add it back after the update with yum install ea-apache24-mod_http2 (on Ubuntu, apt-get install ea-apache24-mod-http2) and restart Apache again.
Apache has fixed a critical flaw in its HTTP/2 module, mod_http2 (CVE-2026-119618), that can lead to remote code execution. It affects Apache HTTP Server 2.4.55 to 2.4.70, and only servers with HTTP/2 turned on.
Status by Apache build: - CloudLinux 9 and 10, system Apache: fixed in mod_http2-2.0.26-6.el9_8.2.alma.1 (CL9) and mod_http2-2.0.29-4.el10_2.2.alma.1 (CL10), in the stable repositories - cPanel servers, EasyApache 4 (all CloudLinux versions): a fixed build with Apache 2.4.71 is being prepared; no release date yet - CloudLinux for Ubuntu 22.04, system Apache: no fix from Ubuntu yet; the HTTP/2 module is off by default - CloudLinux 7 and 8, system Apache: not affected
On CloudLinux 9 and 10, update and restart Apache: dnf clean metadata dnf update mod_http2 systemctl restart httpd
On cPanel servers, remove the HTTP/2 module until the fixed EasyApache 4 build is out: yum remove ea-apache24-mod_http2 /scripts/restartsrv_httpd
On CloudLinux for Ubuntu 22.04, use apt-get purge ea-apache24-mod-http2 instead of remove.
On CloudLinux for Ubuntu 22.04 with the system Apache, if apache2ctl -M | grep -w http2_module prints anything, turn the module off with a2dismod http2 and restart Apache.
Clients connect over HTTP/1.1 while HTTP/2 is off.
To check a server: - Which Apache it runs (CloudLinux 7 to 10): rpm -qf "$(command -v httpd)" prints an httpd package for the system Apache and an ea-apache24 package for EasyApache 4 - CloudLinux 9 and 10, system Apache: rpm -q --changelog mod_http2 | grep CVE-2026-119618 prints a line when the fix is installed; rpm -q mod_http2 shows the installed build - cPanel servers: rpm -q ea-apache24-mod_http2 (dpkg -s ea-apache24-mod-http2 on CloudLinux for Ubuntu 22.04) reporting the package as not installed means Apache doesn't serve HTTP/2 and the server isn't exposed