# Debian bookworm and Amazon Linux gain fixes for Apache HTTP/2 flaw

_Published Friday, November 13, 2026 at 1:07 AM EST · Security · Latest · Tier 2 — Notable_

![Debian bookworm and Amazon Linux gain fixes for Apache HTTP/2 flaw — Primary](https://assets.st-note.com/production/uploads/images/335349416/rectangle_large_type_2_43cfe6750df5d1a7b6c7ad841cf0b342.png?fit=bounds&quality=85&width=1280)

Debian bookworm, Amazon Linux 2 and Amazon Linux 2023 now have patched packages for CVE-2026-119618, according to an updated technical account on note. The Apache HTTP Server flaw can cause heap corruption and potentially allow unauthenticated remote code execution when HTTP/2 is enabled.

Bookworm's fix is apache2 2.4.71-1~deb12u1; Amazon's fixes are 2.4.71-1.amzn2.0.1 and 2.4.71-1.amzn2023.0.1. Debian forky and Amazon Linux 2027 Preview still lacked patches at the November 13 check. A public proof of concept reproduced heap corruption, but the account did not establish successful code execution or actual exploitation.

## Sources

- [note](https://note.com/gpt_mindcraft/n/nb273027b9b6e?hl=en)

---
Canonical: https://techandbusiness.org/newswire/HUi67cJFMWtq_SHMPhsR8_
Published: 2026-11-13T06:07:43.525Z
Story chronology: 2026-11-12T20:52:00.000Z
Retrieved: 2026-11-13T08:29:47.047Z
Publisher: Tech & Business (techandbusiness.org)