Critical Apache HTTP/2 Vulnerability (CVE-2026-119618): How Imperva Protects Customers

A critical vulnerability was disclosed today in the HTTP/2 module of Apache HTTP Server, one of the most widely deployed web servers in the world. Tracked as CVE-2026-119618, the flaw could allow a remote attacker to run code on an affected server without authenticating. Here is what we know, and how Imperva customers are protected. 

What is the vulnerability? 

CVE-2026-119618 affects mod_http2, the Apache module that implements the HTTP/2 protocol. It has been rated 9.8 out of 10 on the CVSS severity scale. An attacker who can reach a vulnerable server over HTTP/2 can potentially take control of the server process, with no credentials required. 

The flaw affects Apache HTTP Server versions 2.4.55 through 2.4.70, as well as standalone builds of the mod_h2 module. Only servers that have HTTP/2 enabled are exposed. The Apache project has released version 2.4.71, which fixes the issue, and operating system vendors are publishing patched packages on their own schedules. 

Public reports differ on whether a working exploit exists. We recommend treating this vulnerability as a serious risk and acting accordingly. 

Are Imperva products affected? 

Imperva Cloud WAF and Imperva WAF Gateway are not affected by this vulnerability. 

How Imperva Cloud WAF protects customers 

Cloud WAF sites are onboarded without HTTP/2 support by default, so customers who have not changed this setting are protected out of the box. The attack traffic never reaches their origin server. 

Customers who have enabled HTTP/2 can remain protected by choosing only the “HTTP/2 client to Imperva” option. With this option, HTTP/2 is handled at Imperva and the attack traffic doesn’t reach the origin. 

How Imperva WAF Gateway protects customers 

When deployed in reverse proxy mode with HTTP/2 support disabled, WAF Gateway drops HTTP/2 traffic, blocking this attack. Customers who have enabled HTTP/2 can mitigate this risk by disabling HTTP/2 support in their WAF Gateway Web Service configuration. This prevents HTTP/2 attack traffic from reaching their origin servers. For deployments running in bridge mode, where HTTP/2 traffic is passed through to the origin, customers should take additional steps to protect their Apache servers.  

What should you do now? 

Regardless of how you deploy Imperva, we recommend identifying any Apache HTTP Server instances in your environment that have HTTP/2 enabled and applying the vendor fix as soon as it is available for your platform. Review your HTTP/2 settings in your Imperva configuration to confirm which of the protections above applies to you.  

Our teams continue to investigate additional mitigation options for customers who need to maintain HTTP/2 support and will provide updates as they become available. 

Need help? 

For details about your specific configuration, or help reviewing and changing your HTTP/2 settings, please contact Imperva Support. We will continue to update this post as our investigation progresses. 

The post Critical Apache HTTP/2 Vulnerability (CVE-2026-119618): How Imperva Protects Customers appeared first on Blog.