Vulnerability CVE-2026-119618: Remote code execution in Apache HTTP Server mod_http2

Situation

A security vulnerability was discovered in the mod_http2 module of Apache HTTP Server, which is used by EasyApache 4 in cPanel & WHM. The vulnerability is a concurrency flaw in the assign_headers() function and has been identified as CVE-2026-119618.

Affected product version

Impact

Remote code execution (RCE) is possible through the mod_http2 module of affected Apache HTTP Server versions.

Call to action

EasyApache 4 v25.96 includes ea-apache24 2.4.71-1, which contains the upstream fix for CVE-2026-119618. Update the ea-apache24 package to this version or newer.

Warning: The following steps may briefly restart Apache, which causes a short service interruption.

1. Log into the server via SSH.

2. Run the following command:

   # /scripts/update-packages

How to confirm the patched version is installed

Check the installed ea-apache24 version and make sure it matches or is newer than the version in the Patched versions column above. On CloudLinux, AlmaLinux and Rocky Linux, run:

# dnf list installed ea-apache24

On Ubuntu, run:

# apt policy ea-apache24