Customer Security Advisory: Remote code execution vulnerability in the Apache HTTP Server's HTTP/2 module

Akamai is aware of the recently published remote code execution (RCE) vulnerability in the Apache HTTP Server's HTTP/2 module (CVE-2026-119618). Our subject matter experts (SMEs) are actively investigating its potential impact across our platform and infrastructure. If the vulnerability is exploited, unauthenticated remote attackers can trigger heap corruption and potentially execute arbitrary code with the privileges of the web server process. The affected versions are Apache HTTP Server versions 2.4.55 through 2.4.70 (only servers with HTTP/2 enabled are affected). We will post more details for customers and partners with a valid Control Center login at https://community.akamai.com/customers/s/feed/0D5a700001ewU8ICAU as additional information becomes available. If you have questions or are experiencing an impact due to this issue, please use the Support Center in the Akamai Community or Akamai Control Center to contact Akamai Technical Support. Contact information is available at https://www.akamai.com/us/en/support/.

Akamai continues to investigate the potential impact of this vulnerability across our platform and infrastructure. Akamai SMEs are taking action where necessary, and we will provide additional updates as more information becomes available. Customers and partners with a valid Control Center login can find more details at https://community.akamai.com/customers/s/feed/0D5a700001ewU8ICAU. If you have questions or are experiencing impact related to this issue, please use the Support Center on Akamai Community or Akamai Control Center to contact Akamai Technical Support. Contact information is available at https://www.akamai.com/us/en/support/.