Critical Apache HTTP/2 Flaw (CVE-2026-119618) Enables Unauthenticated Remote Code Execution

mod_http2 vulnerability (CVSS critical) in Apache HTTP Server 2.4.55–2.4.70 allows unauthenticated RCE on servers with HTTP/2 enabled; fixed in 2.4.71.