Apache mod_http2 flaw scored 9.8, fix said to be in 2.4.71

A warning on Reddit's self-hosted community flagged a critical flaw in Apache HTTP Server's HTTP/2 module and told operators to act if their distribution has not yet shipped 2.4.71.

The issue is CVE-2026-119618. As described in the alert, it is remote code execution in mod_http2 and carries a CVSS score of 9.8, which places it in the critical band. A flaw of that kind in a module many servers enable for HTTP/2 would let an attacker run code on the host if the bug is reachable over the network.

The alert ties the fix to Apache 2.4.71 and urges a quick check plus mitigation where that release is not yet packaged. It does not, as posted, spell out affected version ranges, a vendor advisory, or the interim workaround. Sites still on older Apache builds with HTTP/2 enabled are the ones the warning treats as exposed until distributors ship 2.4.71.