Executive summary
USN‑8571‑2 releases a corrective update for a regression introduced by the previous security fix (USN‑8571‑1). The regression could cause Apache HTTP Server to fail to start when HTTP/2 proxying is enabled, leading to service interruption.
What is affected
- Apache HTTP Server packages on Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
- The issue manifests only when the mod_http2 module is used for proxying.
Severity and evidence
- The advisory does not provide a CVSS score or formal severity rating for the regression.
- The impact is a Denial‑of‑Service condition (service fails to start). No remote code execution or data leakage is reported.
Business or operational impact
- Web services relying on Apache with HTTP/2 proxying may experience unexpected downtime.
- Potential loss of availability for customer‑facing applications and internal services.
Detection considerations
- Check system logs (`/var/log/apache2/error.log`) for messages indicating failure to start related to HTTP/2 proxying.
- Use `systemctl status apache2` to verify the service state after a restart.
- Monitor monitoring tools (Nagios, Zabbix, etc.) for Apache service health alerts.
Recommended defensive actions
Apply the USN‑8571‑2 update immediately from the Ubuntu security repository:
sudo apt update && sudo apt install –only-upgrade apache2
“`
Verify the package version matches the one listed in the advisory.
Restart Apache and confirm it starts without errors.
Workarounds or mitigations, if supported
- Temporary mitigation: Disable HTTP/2 proxying until the update is applied. This can be done by removing or commenting out `Protocols h2 h2c` and related `ProxyPass` directives that use HTTP/2.
- Ensure that any custom modules or third‑party extensions are compatible with the updated Apache version.
Patch or remediation status
- The regression fix is available as part of the USN‑8571‑2 security notice. No additional patches are required.
References
- Ubuntu Security Notice USN‑8571‑2: https://ubuntu.com/security/notices/USN-8571-2
- Original advisory USN‑8571‑1 (details of the underlying CVEs).
Publication date and last checked date
- Publication date: 2026‑09‑10
- Last checked: 2026‑09‑14