---
title: Tip: find which Apache servers actually have HTTP/2 turned on, and patch those first | ctxsec
url: https://ctxsec.com/items/tip-find-apache-servers-with-h2-in-protocols-before-cve-2026-119618-patch
description: "CVE-2026-119618 only matters where mod_http2 is loaded and h2 or h2c is listed in Protocols. A quick inventory tells you which hosts to patch first and which can drop HTTP/2 for a day."
status: "operational guidance based on the Apache and Red Hat advisories for CVE-2026-119618 (Nov 11, 2026)"
published: 2026-11-11
---

> CVE-2026-119618 only matters where mod_http2 is loaded and h2 or h2c is listed in Protocols. A quick inventory tells you which hosts to patch first and which can drop HTTP/2 for a day.

[← Tips & Guides](/tips) · [markdown](/items/tip-find-apache-servers-with-h2-in-protocols-before-cve-2026-119618-patch.md)

operational guidance based on the Apache and Red Hat advisories for CVE-2026-119618 (Nov 11, 2026)

2026-11-11 3:36 PM ET

### Tip: find which Apache servers actually have HTTP/2 turned on, and patch those first

- **Check the config:** `apachectl -M | grep http2` shows whether the module is loaded; `grep -Ri '^\s*Protocols' /etc/apache2 /etc/httpd` shows where h2 or h2c is enabled.
- **Check from outside:** `curl -sI --http2 https://host/ -o /dev/null -w '%{http_version}\n'` prints 2 if the server negotiates HTTP/2.
- **Check the version:** `httpd -v` or `apache2 -v`; 2.4.55 through 2.4.70 are affected, and so are bundled builds in appliances and control panels.
- **Stopgap:** set `Protocols http/1.1` and reload. Put a CDN or reverse proxy in front only if it terminates HTTP/2 itself and talks HTTP/1.1 to Apache.

Sources: [Apache HTTP Server 2.4 vulnerabilities: fixed in 2.4.71 (Nov 11, 2026)](https://httpd.apache.org/security/vulnerabilities_24.html) · [Red Hat: CVE-2026-119618](https://access.redhat.com/security/cve/cve-2026-119618)