STIGQter: STIG Summary: Web Server Security Requirements Guide Version: 4 Release: 5 Benchmark Date: 01 Jul 2026:

The web server must use HTTP/2, at a minimum.

DISA Rule

SV-264362r984431_rule

Vulnerability Number

V-264362

Group Title

SRG-APP-000439

Rule Version

SRG-APP-000439-WSR-000192

Severity

CAT II

CCI(s)

CCI-002418 - Protect the confidentiality and/or integrity of transmitted information.

Weight

Fix Recommendation

Configure the web server to use HTTP/2, at a minimum.

Note that browsers support HTTP/2 only in HTTPS mode. The tunneling of HTTP/1.x through HTTPS is not an approved configuration.

Check Contents

Verify the web server uses HTTP/2.

If the web server does not use HTTP/2 at a minimum, this is a finding.

Vulnerability Number

V-264362

Documentable

False

Rule Version

SRG-APP-000439-WSR-000192

Severity Override Guidance

Verify the web server uses HTTP/2.

If the web server does not use HTTP/2 at a minimum, this is a finding.

Check Content Reference

Target Key

2910