Skip to main content

Critical Apache HTTP/2 Vulnerability (CVE-2026-23918)

Apache HTTP/2 vulnerability mitigation guide for cPanel servers, including how to disable mod_http2 on legacy systems and update guidance for patched servers.

A critical vulnerability affecting Apache HTTP Server with HTTP/2 enabled has been identified and assigned CVE-2026-23918.

This issue impacts systems running vulnerable versions of Apache with the mod_http2 module enabled. Successful exploitation could allow attackers to cause service instability or denial of service conditions.

Are Hostek Servers Affected?

Systems running newer, supported versions of cPanel & WHM with automatic updates enabled have already received patched Apache packages through standard system updates. This applies to both Shared and VPS hosting customers.

No customer action is required on fully updated systems.

However, older or legacy servers that are unable to update to the patched Apache version may remain vulnerable if HTTP/2 is enabled.

Recommended Mitigation for Legacy Systems

If your server cannot currently be upgraded or patched, the recommended temporary mitigation is to disable HTTP/2 support by removing the Apache mod_http2 module.

Disabling HTTP/2 does not disable HTTPS or SSL functionality. Websites will continue operating normally over standard HTTP/1.1 connections.

Most users will notice little to no difference beyond a possible minor reduction in page load optimization performance.

How to Disable HTTP/2 in EasyApache 4

  1. Log into WHM as the root user.

  2. Navigate to:

    WHM → Software → EasyApache 4

  3. Click Customize.

  4. Select Apache Modules.

  5. Search for:

    mod_http2

  6. Toggle the module OFF.

  7. Click Review.

  8. Click Provision to apply the changes.

Apache will automatically rebuild and restart during provisioning.

How to Verify HTTP/2 Has Been Disabled

After the changes are applied, websites will continue functioning normally, but browsers will connect using HTTP/1.1 instead of HTTP/2.

Administrators can verify the change from the command line with:

curl -I --http2 https://yourdomain.com

If HTTP/2 is disabled, the request will fall back to HTTP/1.1.

Additional Notes

  • HTTPS/SSL certificates remain fully functional

  • cPanel, WHM, and hosted websites continue operating normally

  • CDN services such as Cloudflare may still provide HTTP/2 between visitors and the CDN edge network

  • This mitigation is intended as a temporary workaround until the server can be fully updated

We strongly recommend keeping cPanel, Apache, and operating system packages fully updated to ensure continued security protection against newly disclosed vulnerabilities.

Did this answer your question?