How-To: Check Whether Your Apache Servers Speak HTTP/2, and Turn It Off Until You Patch

After the mod_http2 RCE, here’s how I checked my WordPress web servers. It takes about ten minutes.

1. Check the version

apachectl -v        # Debian/Ubuntu: apache2 -v, RHEL: httpd -v

Upstream fixed it in 2.4.71, but distros backport fixes without changing the version number, so check your distro’s security tracker or package changelog too:

apt changelog apache2 | head -20      # Debian/Ubuntu
rpm -q --changelog mod_http2 | head   # RHEL family

2. Is mod_http2 loaded?

apachectl -M 2>/dev/null | grep -i http2

3. Is HTTP/2 actually on?

grep -RniE '^\s*Protocols' /etc/apache2 /etc/httpd 2>/dev/null

Look for h2 or h2c, both server-wide and in every vhost. Then test from outside:

curl -sI --http2 https://example.com -o /dev/null -w '%{http_version}\n'

2 means HTTP/2. 1.1 means it isn’t being offered.

4. Check every box at once

My servers are managed with Ansible, so I run it once across all of them:

ansible webservers -b -m shell -a "apachectl -v; apachectl -M 2>/dev/null | grep -i http2"

5. Can’t patch yet? Drop to HTTP/1.1

Protocols http/1.1

Set that wherever h2 appears. Then run apachectl configtest and reload. I made the change in my Ansible template, not by hand, so the next run doesn’t put it back. Switch it back on once the fixed package is in.

God Bless, and Happy hacking!

References & Further Reading

• Critical Apache HTTP/2 flaw could let unauthenticated attackers execute code remotely (The Hacker News)
• Apache mod_http2 documentation (Apache)
• Apache Protocols directive (Apache)
• How-To: Check whether your website actually speaks HTTP/3 (EtherNinja)