Quick summary: Searches for "Apache HTTP/2 vulnerability" are trending again. If your website runs on Apache HTTP Server (very common on cPanel and shared hosting), several serious HTTP/2 flaws were fixed in 2026. The two most important are CVE-2026-23918, a bug that can crash a server and possibly let attackers run code, and CVE-2026-49975, the "HTTP/2 Bomb" denial-of-service flaw. Here is what they mean in simple words and exactly what to update.
What is HTTP/2 and why does it matter?
HTTP/2 is the modern way browsers talk to web servers. It makes websites load faster by sending many requests over one connection. Most hosting companies turn it on by default. Because it is so widely used, any bug in a server's HTTP/2 code can affect millions of websites at once.
CVE-2026-23918: double-free bug with possible remote code execution
- Severity: CVSS 8.8 (high/critical).
- Affected version: Apache HTTP Server 2.4.66 with the
mod_http2module enabled, mainly on multi-threaded setups (the "worker" and "event" MPMs). - What it does: a specially crafted sequence of HTTP/2 requests triggers a "double free" memory error. At minimum this can crash the server (denial of service). Researchers also showed a path to remote code execution on common Linux setups.
- Fixed in: Apache 2.4.67 (released in May 2026).
In simple words: an attacker could knock your site offline, and in the worst case take control of the server process, just by sending tricky web traffic.
CVE-2026-49975: the "HTTP/2 Bomb"
Disclosed in June 2026, the HTTP/2 Bomb is a denial-of-service technique where tiny HTTP/2 headers force a server to use a huge amount of memory. The same research affected several web servers and proxies, including nginx, Envoy and Cloudflare, but each vendor has its own fix and its own CVE number. For Apache, the issue is tracked as CVE-2026-49975 and is related to how split cookie headers were counted against request limits.
Apache's first official fix arrived in version 2.4.68, which patched 13 vulnerabilities in total. All Apache versions from 2.4.0 up to 2.4.67 are affected by at least some of those issues.
What should you do? (Step by step)
- Check your Apache version. On a server, run
apachectl -vorhttpd -v. On shared hosting, ask your host or check the cPanel server information page. - Update to Apache 2.4.68 or newer. This covers both CVE-2026-23918 and the HTTP/2 Bomb. Version 2.4.67 only fixes the first one.
- cPanel users: run the EasyApache 4 update. cPanel has already pushed patched packages for the 2026 Apache CVEs.
- Can't update right now? As a temporary workaround you can turn off HTTP/2 by setting
Protocols http/1.1in your Apache configuration. This lowers the risk but does not remove the bug, so still plan the update. - Using Docker or containers? Rebuild your images with the patched Apache version; updating the host alone is not enough.
- Behind nginx, Envoy or a CDN? Check those components too. The HTTP/2 Bomb affected several products, and each needs its own patch.
Is my WordPress or Blogger site affected?
- Blogger, Wix, Shopify and other hosted platforms: the platform manages the servers, so you do not need to do anything.
- WordPress on shared hosting: your hosting company is responsible for Apache updates, but it is worth sending them a quick message to confirm they are on 2.4.68 or later.
- VPS or dedicated server: you (or your admin) must update Apache yourself.
Basic security habits for every website owner
- Turn on automatic security updates where possible.
- Use a web application firewall (WAF) or a CDN in front of your site.
- Keep regular off-site backups so you can recover quickly after any attack.
- Subscribe to security news or your host's status page so you hear about critical patches early.
FAQ
Which Apache version is safe?
Apache HTTP Server 2.4.68 or newer fixes the known 2026 HTTP/2 issues, including CVE-2026-23918 and CVE-2026-49975.
Is turning off HTTP/2 enough?
It is only a temporary workaround. Updating Apache is the real fix.
Does this affect normal internet users?
No action is needed by visitors. This is a server-side problem for website owners and hosting companies.
Sources
- The Hacker News: Critical Apache HTTP/2 flaw CVE-2026-23918
- Indusface: CVE-2026-23918 analysis and mitigation
- cPanel Support: Apache HTTP Server CVE-2026-23918 and related patches
- Daily Security Review: Apache 2.4.68 patches 13 CVEs including HTTP/2 DoS
- SC Media: Apache fixes critical HTTP/2 vulnerability