Apache HTTP/2 vulnerability (CVE-2026-119618)

Servers managed by ServerPilot are not vulnerable to the critical Apache HTTP/2 vulnerability (CVE-2026-119618). No action is needed.

The vulnerability is in Apache’s HTTP/2 module, mod_http2. ServerPilot’s Apache is not built with this module, so the vulnerable code is not present on servers managed by ServerPilot.

About the vulnerability

CVE-2026-119618 is a race condition in how Apache’s mod_http2 module handles headers. It can corrupt memory on the server and lead to remote code execution.

The vulnerability affects Apache 2.4.55 through Apache 2.4.70. The Apache HTTP Server project rated it critical and fixed it in Apache 2.4.71, released on November 11, 2026 (Apache’s security advisory).

Why ServerPilot servers are not affected

HTTP/2 connections to apps on ServerPilot servers are handled by Nginx, which passes requests on to Apache over HTTP/1.1. In addition, ServerPilot does not build its Apache package, sp-apache, with mod_http2, so the vulnerable code is not present on the server at all.

Security scanners

A security scanner that checks only Apache’s version number may report servers managed by ServerPilot as vulnerable to CVE-2026-119618 while their Apache version is older than 2.4.71. This is a false positive. The version is in the affected range, but the scanner cannot tell that ServerPilot’s Apache is not built with the vulnerable HTTP/2 module.

Contact support

If you have questions about your server, please contact support.